Turn On Two-Factor Authentication on Windows 11

What 2FA is and why it helps

Two-factor authentication (2FA) asks for a second proof that it is really you, beside your password.

• Better security. A stolen password alone is no longer enough.
• Protection from phishing and password attacks.
• Safer after data leaks. A leaked password does not open the account.
• Many methods. Pick what suits you.

Common types of 2FA:

1. SMS or text message with a code.
2. Authenticator apps that make codes.
3. Biometrics such as a fingerprint or face.
4. Hardware keys such as USB security keys.

Set up Windows Hello

Windows Hello lets you sign in with a face, a fingerprint or a PIN.

1. Click the Start button, then Settings.
2. Open Accounts.
3. Click Sign-in options.

   

4. Under Windows Hello, choose a method (face, fingerprint or PIN) and click Set up.
5. Follow the steps on the screen.

   

Set up Microsoft Authenticator

For your Microsoft account, you can add a second step with an authenticator app.

1. On your phone, install Microsoft Authenticator from the App Store or Google Play.
2. Go to your Microsoft account security page (account.microsoft.com/security) and sign in.
3. Open Advanced security options, and choose Add a new way to sign in or verify, then Use an app.
4. Scan the QR code with the app and approve the sign-in on your phone.
5. Turn on Two-step verification.
6. Save the recovery code in a safe place.

From now on, Windows asks for the code or the approval when you sign in with your Microsoft account in a new place.

Tips

• Keep your recovery codes and a backup method.
• Use an authenticator app and not SMS when you can, because SMS can be intercepted.
• Keep Windows updated.

Quick recap

• Use Settings, Accounts, Sign-in options for Windows Hello.
• Add the Microsoft Authenticator app for two-step verification.
• Store your recovery code.