How to set up 2FA on Microsoft account
Checked against Microsoft account's own help on 10 October 2026. Menus change, so follow the nearest label if yours differs.
Short answer
Open Microsoft account's security settings (account.microsoft.com/security, Manage how I sign in), choose the authenticator app option, and scan the QR code Microsoft account shows with KeyNesta (or enter the setup key by hand). Type the six-digit code KeyNesta shows back into Microsoft account to finish, and save the recovery material Microsoft account gives you before you close the page.
Before you start
Have KeyNesta open and unlocked before Microsoft account shows the QR code, so the code is ready the moment it appears. KeyNesta needs no account to do this. It stores authenticator-app codes only: it does not do passkeys or hardware security keys, and where Microsoft account offers those you set them up in Microsoft account directly.
Steps
- Sign in at
account.microsoft.com/securityand select Manage how I sign in. - Under Two-step verification, choose Turn on if it is off.
- Add an authenticator app as a sign-in or verification method. Microsoft offers its own app first; if you see Set up a different authenticator app, choose it and select Next to reveal the QR code.
- Add it to KeyNesta. Open the KeyNesta web app (or the app on your phone once it is released), unlock your vault, choose Scan QR and point the camera at the code on screen. If you cannot scan, use Import QR image, or choose Add entry to paste the setup key.
- Enter the six-digit code from KeyNesta when Microsoft asks you to verify.
- Generate a Microsoft account recovery code (Microsoft has a help page for it) and store it away from the phone.
| Microsoft account | What to know |
|---|---|
| Where to start | account.microsoft.com/security, Manage how I sign in |
| Setup key as text | Microsoft's help for personal accounts does not document a text-key option, so use the QR code. |
| Recovery material | Microsoft supports a recovery code for personal accounts, and advises keeping several security contacts on the account as well. |
| Source | Microsoft Support: How to use two-step verification with your Microsoft account |
Backup and recovery for Microsoft account
Microsoft supports a recovery code for personal accounts, and advises keeping several security contacts on the account as well.
Save whatever Microsoft account gives you somewhere that is not the phone holding your codes. Where to store your 2FA backup codes compares the options, and 2FA backup and sync covers backing up the KeyNesta vault itself.
Things to know about Microsoft account
- This page is for a personal Microsoft account. A work or school account is managed by an administrator and uses a different security-info page, where the wizard has an I want to use a different authenticator app option.
- Microsoft's help is written around its own Microsoft Authenticator, so the labels can differ slightly between regions and over time.
Source
Menu paths on this page come from Microsoft Support: How to use two-step verification with your Microsoft account, read on 10 October 2026. KeyNesta is not affiliated with Microsoft account.
Frequently asked questions
Can I use KeyNesta as the authenticator app for Microsoft account?
Yes. Microsoft account asks for a standard time-based code, and KeyNesta reads the same QR code or setup key and generates that code on your device, offline. Microsoft account does not learn which app you chose. KeyNesta holds authenticator-app codes only; it has no passkey or hardware security key support. How to add the code is in How do I add a 2FA code to KeyNesta?
What happens to my Microsoft account 2FA if I lose my phone?
Use another verification method on the account, your recovery code, or Microsoft's account recovery form. If your KeyNesta vault is synced or you made an encrypted backup, you can restore the codes on another device; the lost phone guide covers the order to do things in.
How do I add Microsoft account to KeyNesta if I cannot scan the QR code?
Microsoft's help for personal accounts does not document a text-key option, so use the QR code. If you only have the phone that holds KeyNesta, upload a screenshot of the QR with Import QR image. In KeyNesta you can also upload a screenshot with Import QR image, paste an otpauth:// link, or add the entry by hand with the secret. Delete any screenshot of the QR afterwards: it works like a password.
Can I use the same Microsoft account code on two devices?
Codes come from a shared secret, so any app that holds the secret shows the same codes. The tidy way is KeyNesta's optional end-to-end encrypted sync, which carries the vault to a second device. The alternative is to add the secret to a second app while the QR code is still on screen; once Microsoft account stops showing it, you cannot get it back without re-enrolling.
Can I use passkeys with Microsoft account as well as KeyNesta?
Microsoft has a help page for creating and saving a passkey and another for security keys. KeyNesta does not support passkeys or hardware security keys; it holds the authenticator-app code only, which can sit beside them.
Can a Microsoft account use an authenticator app that is not Microsoft Authenticator?
Yes. Microsoft's own help describes a "Set up a different authenticator app" option, which shows a standard QR code any TOTP app can read. Microsoft Authenticator is only the app it suggests first.
Do app passwords still matter once two-step verification is on for my Microsoft account?
Yes for older apps. Microsoft's help says apps that cannot accept a normal code need an app password, and the App passwords section only appears once two-step verification is on.
Try KeyNesta free. The web app needs no sign-up.
Open the web app All platforms