Microsoft 2FA setup
Microsoft account security (Outlook, Windows, Xbox, Office) pushes hard toward its own Authenticator and passkeys — but a standard TOTP setup key is always available if you know where to look. Here's the path.
Fact-checked against Microsoft's official documentation · last reviewed 7 November 2026 · how we review guides
Open the generator for MicrosoftStep by step
- 01
Open Microsoft account security
Sign in at account.microsoft.com and open Security → “Manage how I sign in”. Personal accounts land in your profile; work accounts use the same TOTP standard through Entra ID security info.
- 02
Decline the Authenticator-app download
Microsoft offers its mobile Authenticator first. Decline the download and choose the option to use a different authenticator app instead — the wizard then shows the classic QR-code setup screen for any authenticator app.
- 03
Reveal the secret key
On the QR screen choose “Can’t scan the image?” (or “enter code manually”). A Base32 setup key appears — letters A–Z and digits 2–7, no spaces.
- 04
Paste the key into the generator
Paste it into 2facounter.com and the live 6-digit code appears immediately. Prefer your camera? Screenshot the QR and press Ctrl+V on the page instead — nothing is uploaded to anyone.
- 05
Confirm the code
Copy the token and enter it in Microsoft’s confirmation field. Once accepted, the app entry appears in your sign-in methods list alongside your password and any passkeys you keep.
- 06
Archive key and recovery info
Save the Base32 key in your encrypted password manager as master copy and verify a fallback email/phone exists in your profile. Note that Microsoft is phasing out SMS as a sign-in and recovery method for personal accounts, so an email fallback — or better, a printed code — is the durable option.
FAQ
Is Microsoft Authenticator required for Microsoft 2FA?
No. Microsoft’s Authenticator app is the default suggestion, but personal accounts support standard RFC 6238 TOTP — the same algorithm every authenticator uses. Choosing “use an app” without native app support delivers a setup key that works everywhere.
My work/school Microsoft 365 account has no authenticator option — why?
Entra ID (Azure AD) administrators can restrict which sign-in methods are allowed. If “authenticator app” is greyed out, your organization has limited methods to passkeys or its mobile app. Contact your IT admin — this site cannot bypass the policy, and shouldn’t.
Does 2FA get demanded for Xbox or Outlook too?
Yes — they all sit behind the same Microsoft account, so a single enrollment covers Xbox sign-ins, Outlook.com mail, OneDrive, and Microsoft Store purchases. Some flows (new devices, region changes) will demand the code even from already-trusted apps, so the generator being a bookmark away matters.