How to Secure Microsoft Account: Step-by-Step

Securing your Microsoft account protects your email, files in OneDrive, Xbox profile, and any services tied to that login. This guide walks through the essential settings you should change or verify today, starting from a standard account. You’ll need access to the email or phone number currently linked to the account, and about 15 minutes.

What You’ll Need

Your Microsoft account email and password
Access to the recovery email or phone number on file
A smartphone with an authenticator app (Microsoft Authenticator recommended, but Google Authenticator works too)

Step-by-Step

Sign in to your Microsoft account security page. Go to account.microsoft.com/security and sign in with your credentials. If you’re already signed in to a Microsoft service, this page will open directly.
Change your password to a strong, unique one. Under “Password security,” select “Change my password.” Use at least 12 characters, mixing uppercase, lowercase, numbers, and symbols. Do not reuse this password anywhere else. If you use a password manager, let it generate a random one.
Add or update your sign-in verification methods. Under “Sign-in methods,” click “Add a new way to sign in or verify.” Add both a phone number and an alternate email address. These are your recovery options if you get locked out. Keep them current.
Turn on two-step verification (2FA). Under “Two-step verification,” click “Turn on.” Microsoft will ask you to verify each method you have. Once enabled, you’ll need a code from your phone or authenticator app every time you sign in on a new device. This is the single most effective step to block unauthorized access.
Set up the Microsoft Authenticator app. Install the app on your phone, then in your security settings under “Sign-in methods,” choose “Add a new way to sign in or verify” and select “Use an app.” Scan the QR code with the app. This gives you push notifications and a time-based code that works offline.
Review and remove old or unfamiliar devices. On the security page, go to “Devices” and review the list. For any device you don’t recognize or no longer use, click “Remove.” This revokes that device’s access to your account.
Check your recent activity. On the security page, select “View my activity.” Look for sign-ins from unusual locations, browsers, or times. If you see something suspicious, click “Secure account” and follow the prompts to change your password and sign out everywhere.
Set up account alerts. Under “Account alerts,” choose to receive email or text notifications when there’s a sign-in on a new device or a password change. This gives you early warning of a breach.
Review app and service permissions. Go to account.microsoft.com/privacy and click “Apps and services that can access your data.” Remove any app you don’t recognize or no longer use. This limits what third parties can do with your account.
Enable passwordless sign-in (optional but recommended). In the security settings, under “Additional security options,” turn on “Passwordless account.” This removes your password entirely and uses the Authenticator app instead. If you lose your phone, you can still recover via your recovery email or phone.

Common Mistakes

Skipping 2FA because it’s inconvenient. The few extra seconds are worth it. Accounts without 2FA are far more likely to be compromised.
Using the same password for your Microsoft account and other sites. If one site gets breached, attackers will try that password on your email. Always use a unique password.
Ignoring security alerts. If Microsoft sends you a “suspicious sign-in” email, don’t delete it. Act on it immediately.
Not updating recovery info. If you change your phone number or email, update it in your security settings right away. Otherwise, you’ll be locked out when you need it most.
Leaving old devices signed in. When you sell or give away a device, remove it from your Microsoft account first. Otherwise, the new owner may have access.

Tips

Use a password manager to generate and store a strong, unique password for your Microsoft account. This makes it easy to have a different password for every site.
Turn on “Windows Hello” on your PC (face, fingerprint, or PIN) for quick and secure sign-in without typing your password each time.
Set up a recovery code or print a backup code when you enable 2FA. Store it in a safe place (e.g., a physical safe or encrypted file).
Check your security settings every few months. Microsoft occasionally adds new features, and your recovery info may need updating.
If you use the same Microsoft account for work or school, your organization may have additional security requirements. Follow those as well.

Troubleshooting

You don’t have access to your recovery email or phone. If you’re locked out, go to account.live.com/acsr and fill out the account recovery form. You’ll need to provide as much detail as possible (e.g., previous passwords, subject lines of emails you sent, purchase history). This process can take up to 24 hours.
2FA codes aren’t working. Make sure your phone’s time is set to automatic. If you’re using the Authenticator app, try refreshing the code or manually adding the account by entering the secret key. If you’re receiving codes via text, check that your carrier isn’t blocking Microsoft’s number.
You suspect your account was already hacked. Go to account.microsoft.com/security and click “Secure account.” Follow the steps to change your password, sign out of all devices, and review your recovery info. If you can’t sign in, use the recovery form linked above.
Microsoft Authenticator push notification isn’t appearing. Ensure your phone has internet access and that the app is allowed to send notifications. If not, open the app and approve the request manually. Alternatively, use the time-based code shown in the app.
You removed a device by mistake. You can re-add it by signing in on that device again. If it’s a phone, go to Settings > Accounts > Add account and sign in with your Microsoft account.

Frequently Asked Questions

What if I lose my phone after enabling 2FA?

Use your recovery email or phone number to get a code. If you set up backup codes, use one. If you have none of those, you’ll need to go through the account recovery form. That’s why it’s critical to keep recovery info up to date.

Is two-step verification really necessary?

Yes. It’s the most effective way to stop unauthorized access. Even if someone steals your password, they can’t get in without the second factor. Microsoft reports that 2FA blocks over 99% of automated attacks.

Can I use a third-party authenticator app instead of Microsoft Authenticator?

Yes. Microsoft supports any TOTP-based authenticator app, such as Google Authenticator or Authy. When setting up, choose “Use an app” and scan the QR code with your preferred app.

How do I remove a device I no longer have?

Go to account.microsoft.com/devices, sign in, find the device, and select “Remove.” This will sign the device out of your account and revoke access to services like OneDrive and Office.

What does “passwordless account” mean?

It removes your password entirely. You sign in using the Microsoft Authenticator app or a security key. This is more secure because there’s no password to steal. You can still reset to a password later if needed.

Why did I get an email about a new sign-in that wasn’t me?

Someone may have tried to access your account. Immediately change your password and review your recent activity. If you have 2FA enabled, they shouldn’t have gotten in, but still secure your account as a precaution.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →