Appearance
Summary
Your Microsoft 365 account is protected by multiple layers of security — not only a password. This article explains what each layer does, how they work together, what your organization manages versus what you control, and what to do when something seems wrong. Think of it as a security cheat sheet for your work account.
Before You Start
- A Microsoft 365 work account.
- A basic understanding of signing in and using your account (no technical background required).
Instructions
1. The Layers of Security Protecting Your Account
Your account is not protected by a single lock — it is protected by a series of layers, each designed to catch what the layer before it missed.
| Layer | What It Does | Who Manages It | Example |
|---|---|---|---|
| 1. Password | Verifies you know the account's secret | You (with policy set by IT) | Your Microsoft 365 password |
| 2. Multi-Factor Authentication (MFA) | Requires a second proof of identity beyond your password | IT enables it; you register your methods | Authenticator app push notification, phone call, or SMS code |
| 3. Conditional Access | Evaluates sign-in context (device, location, risk level) and decides whether to allow, block, or require extra verification | IT (fully managed — invisible to you) | Blocking sign-ins from untrusted countries, requiring MFA on new devices |
| 4. Threat Protection | Scans emails, links, and attachments for malware, phishing, and suspicious content before they reach you | IT (fully managed — invisible to you) | Safe Links scanning URLs in email, Safe Attachments detonating files in a sandbox |
Key takeaway: You are directly responsible for layers 1 and 2 (password and MFA). Layers 3 and 4 run in the background — you benefit from them without needing to do anything, but understanding they exist helps you trust the system.
2. What You Control vs. What IT Manages
| Security Area | You Control | IT Manages |
|---|---|---|
| Password | Choosing a strong password, changing it when needed | Password complexity requirements, expiration policy |
| MFA | Registering your methods (Authenticator app, phone, security key), approving or denying prompts | Requiring MFA, choosing which methods are allowed, setting trusted locations |
| Devices | Keeping your device updated, locking your screen when you walk away | Device compliance policies, remote wipe capability, managed app requirements |
| Apps | Reviewing and revoking app permissions in the MyApps portal | Blocking risky apps, managing consent policies, monitoring OAuth grants |
| Phishing | Recognizing and reporting suspicious emails | Email filtering rules, Safe Links, Safe Attachments, quarantine policies |
| Sign-in monitoring | Reviewing your own sign-in history at My Sign-Ins | Monitoring all users' sign-in logs, investigating risky sign-ins, triggering alerts |
3. "What Happens If..." — Common Security Scenarios
| Scenario | What Happens | What You Should Do |
|---|---|---|
| Someone gets your password (phishing, data breach) | They can attempt to sign in — but MFA will block them if enabled | Change your password immediately. Review your sign-in activity. Report to IT. |
| You click a link in a phishing email | If Safe Links is active, it may block the page. If not, you may land on a fake login page. | Do not enter credentials. Close the tab. Report the email. If you entered your password, change it immediately and tell IT you submitted it on a phishing page, so they can sign out your active sessions. |
| You get an MFA prompt you did not request | Someone has your password and is trying to sign in. The MFA prompt is your last line of defense. | Tap Deny. Change your password immediately. Report to IT. Never approve an MFA prompt you did not initiate. |
| You lose your phone (your MFA device) | You cannot complete MFA sign-in until you use a backup method or IT resets your MFA | Use a backup MFA method (backup phone, security key). If no backup exists, contact IT to reset your MFA registration. |
| You sign in from a new device or country | Conditional Access may block the sign-in or require additional MFA verification | Complete the additional verification if prompted. If blocked, contact IT to confirm the sign-in is legitimate. |
| Your account gets locked | Too many failed sign-in attempts triggered a lockout (protection against brute-force attacks) | Wait 15–30 minutes for automatic unlock, use self-service password reset, or ask IT to unlock the account if you cannot wait. |
| You receive a "Your sign-in was blocked" email | Conditional Access or risk-based policy blocked a sign-in attempt from an unusual location or device | If it was you, try again from a trusted device or network, or ask IT which policy blocked the sign-in and whether your location can be allowed. If it was not you, change your password immediately. |
4. Your Security Checklist — 5 Things Every User Should Verify
These are the five most impactful things you can do to protect your account. To work through all five in one sitting — plus mailbox rules, recovery details, and device encryption — follow How to Run a Personal Security Checkup in 15 Minutes.
| # | Action | How to Check / Do It | Why It Matters |
|---|---|---|---|
| 1 | Use a strong, unique password | Change it at myaccount.microsoft.com > Password | A weak or reused password is the #1 way accounts get compromised |
| 2 | Register at least 2 MFA methods | Check at mysignins.microsoft.com/security-info | If you lose your phone and have only one method, you are locked out |
| 3 | Review your sign-in activity | Check at mysignins.microsoft.com | Spot unauthorized access before it causes damage |
| 4 | Review apps with access to your account | Check at myapps.microsoft.com | Revoke access for apps you no longer use or did not authorize |
| 5 | Know how to spot phishing | Read How to Identify a Phishing Email | Phishing is the most common attack vector — your awareness is the first line of defense |
5. Understanding MFA Methods — Quick Comparison
| MFA Method | How It Works | Security Level | Convenience | Recommended? |
|---|---|---|---|---|
| Microsoft Authenticator (push) | Approve a notification on your phone | ✅ High — number matching prevents accidental approval | ⭐⭐⭐ Fast | ✅ Yes — the recommended default |
| Microsoft Authenticator (TOTP code) | Enter a 6-digit time-based code from the app | ✅ High | ⭐⭐ Moderate | ✅ Yes — good as a backup |
| SMS text message | Enter a code sent via text | 🔶 Moderate — SMS can be intercepted (SIM-swapping) | ⭐⭐⭐ Fast | ⚠️ Use as backup only, not primary — being retired, see below |
| Phone call | Answer a call and press # to verify | 🔶 Moderate | ⭐ Slow | ⚠️ Use as backup only — being retired, see below |
| FIDO2 Security Key | Plug in or tap a physical USB/NFC key | ✅ Highest — phishing-resistant, no credential transmitted | ⭐⭐⭐ Fast | ✅ Yes — best for high-security roles |
| Windows Hello (biometric/PIN) | Use your face, fingerprint, or device PIN | ✅ High — device-bound, TPM-backed | ⭐⭐⭐ Seamless | ✅ Yes — for Windows devices |
SMS text message and Phone call have an end date. Microsoft is making passkeys the default sign-in experience for work accounts, and the reason it gives is the one in the table: SMS and voice are among the most vulnerable authentication methods available today. From September 1, 2026, passkeys are enabled automatically for anyone currently set up for SMS or voice, and the next time those users sign in and complete MFA they are prompted to register one — a prompt you can snooze, by default as often as you like. From February 1, 2027, organizations that have not arranged their own telecom provider through the Microsoft Security Store can no longer use SMS or voice for MFA, and that covers self-service password reset as well as sign-in. Organizations that do arrange one keep both methods. Nobody is locked out on the date itself: anyone whose only method is SMS or voice gets a prompt to register a passkey that has to be completed before they can carry on signing in.
6. "Something Seems Wrong" — Decision Guide
Use this table to decide what to do when you notice something suspicious.
| What You Noticed | Priority | Action |
|---|---|---|
| Got an MFA prompt I did not request | 🔴 High — someone has your password | Deny the prompt → Change your password → Report to IT |
| Emails I did not send appear in my Sent folder | 🔴 High — account compromised | Change your password → Check for forwarding rules in Outlook Settings → Report to IT |
| Unfamiliar sign-in in My Sign-Ins | 🟠 Medium — possible compromise | If you do not recognize the sign-in, change your password and report to IT. Check if it matches a VPN or travel location. |
| Unexpected password reset email | 🟠 Medium — someone may be trying to reset your password | Do not click links in the email. Go directly to myaccount.microsoft.com. If you did not request a reset, contact IT. |
| An unfamiliar app has access to your account | 🟡 Low-Medium — possible consent phishing | Review and revoke the app at myapps.microsoft.com. Report to IT if you did not authorize it. |
| Locked out after too many failed attempts | 🟡 Low — normal protection | Wait 15–30 minutes, or use self-service password reset at passwordreset.microsoftonline.com. |
Troubleshooting
DANGER
If you receive an MFA prompt you did not initiate, do not approve it. This means someone has your password. Tap Deny, change your password immediately, and tell IT that you received an MFA prompt you did not trigger and roughly when it arrived. That is what prompts them to sign your account out of every session and check where the sign-in came from. Time is critical.
| Symptom / Error | Potential Cause | Solution |
|---|---|---|
| Account locked — "Your account has been temporarily locked" | Too many failed sign-in attempts | Wait 15–30 minutes for automatic unlock. If it is urgent, use self-service password reset or ask IT to clear the lockout now. |
| MFA prompt received but you did not sign in | Someone has your password | Tap Deny. Change your password at myaccount.microsoft.com. Report to IT immediately. |
| "Your sign-in was blocked" email received | Conditional Access blocked a sign-in from an unusual location or device | If the sign-in was yours (e.g., traveling or using VPN), contact IT to verify. If it was not yours, change your password. |
| Cannot sign in — no MFA method available | Lost phone or only one MFA method registered | Use a backup method. If none exists, contact IT to reset your MFA registration. In the future, register at least 2 methods. |
| Unfamiliar app in MyApps portal | Consent phishing or accidental authorization | Remove the app. Report to IT so they can investigate. See How to Manage App Permissions and Connected Apps. |
| Receiving suspicious emails that pass the spam filter | Sophisticated phishing or spear-phishing attempt | Do not click links. Report using the Report button in Outlook. See How to Identify a Phishing Email. |
Related Articles
- How to Understand MFA and Prevent Account Lockouts
- How to Use the Microsoft Authenticator App
- How to Identify a Phishing Email
- How to Recognize and Avoid Tech Support Scams
- How to Verify a Suspicious Call or Message from IT
- How to Run a Personal Security Checkup in 15 Minutes
- How to Spot Fake Microsoft Login Pages
- How to Check Your Sign-In Activity in Microsoft 365
- How to Check If Your Email Was Compromised
- How to Set Up Self-Service Password Reset (SSPR)
- How to Manage App Permissions and Connected Apps in Microsoft 365
- How to Enable Two-Step Verification on Personal Accounts
- Understanding Windows Sign-In Methods — Passwords, PINs, and Biometrics