How to Secure Your Microsoft Account

    Lock down the Microsoft account behind your PC, Xbox and inbox: password, two-step verification, sign-in activity, app access and recovery details.

    JDCS
    By Jordan Dickson · Reviewed by CSG Security Engineers

    Updated July 2026 · 5 min read

    One password stands between an attacker and your Windows PC, your Xbox, your OneDrive files and the inbox that resets everything else you own — that's what a Microsoft account is. This walkthrough makes it genuinely hard to take: two-step verification so a stolen password achieves nothing, a saved recovery code so a lost phone never locks you out, a password used nowhere else, and sign-in methods trimmed to only what's yours. Just recovered the account? This doubles as the hardening pass.

    Good to know

    The reverse is true too: this account is your Outlook / Hotmail sign-in — so everything here also protects the inbox, and vice versa.
    Affiliate disclosure: if you create or upgrade a paid Proton plan through links on this page, CyberSecurityGuides may earn a commission at no extra cost to you. We only recommend tools we use and trust.

    How to lock down your Microsoft account

    1

    Open your sign-in settings

    From a device and browser that are yours, sign in at account.microsoft.com, open Security, then Manage how I sign in. Nearly this whole guide happens on the page that loads — two-step verification, the recovery code and your sign-in methods all live here.
    Microsoft

    Sign in

    yourname@outlook.com

    Password

    Sign in

    Signing in to account.microsoft.com, opening the Security tab and Manage how I sign in, landing on the additional security page

    2

    Register an authenticator app

    App-generated codes are the strongest everyday second step — they're produced on your phone, offline, beyond the reach of a SIM swap. Under Ways to prove who you are, pick Add a new way to sign in or verify, then Use an app. Microsoft pushes its own app first; set up a different Authenticator app lets you use Proton Authenticator or whichever you prefer.

    In your authenticator, scan the QR code on screen, then confirm with the 6-digit code it produces and hit Next. That registers the method — the next step makes it mandatory.

    Microsoft accountYour infoPrivacySecuritySubscriptionsDevices
    Security

    Change password

    Last update: 4/24/2025

    Change ›

    Two-step verification

    OFF

    Manage ›

    Ways to prove who you are

    Manage sign-in and verification options for your Microsoft account.

    Enter password Up to date
    Email a codeyourname@outlook.com Up to date
    + Add another way to sign in to your account

    Additional security

    To increase the security of your account, remove your password or require two steps to sign in.

    Passwordless account

    OFF

    Turn on

    Two-step verification

    OFF

    Turn on

    Ways to prove who you are, Add a new way to sign in or verify, Use an app, set up a different authenticator app, scanning the QR code and entering the verification code

    We recommend Proton Authenticator

    Strong one-time codes that can't be SIM-swapped like a text message — free, open-source, and they stay on your device.

    Set it up in 5 minutes
    3

    Make two-step verification mandatory

    Registering the app made a second step possible — now enforce it. Scroll to Additional security and under Two-step verification choose Turn on; Microsoft verifies the change with the app you just added.

    From here on, any sign-in from unrecognised hardware demands the password plus a live code — which turns a leaked password from a disaster into a non-event.
    Microsoft accountYour infoPrivacySecuritySubscriptionsDevices
    Security

    Change password

    Last update: 4/24/2025

    Change ›

    Two-step verification

    OFF

    Manage ›

    Ways to prove who you are

    Manage sign-in and verification options for your Microsoft account.

    Enter password Up to date
    Email a codeyourname@outlook.com Up to date
    Enter a code from an authenticator app Up to date

    Additional security

    To increase the security of your account, remove your password or require two steps to sign in.

    Passwordless account

    OFF

    Turn on

    Two-step verification

    OFF

    Turn on

    Security page Additional security section, turning on Two-step verification using the authenticator app you added

    First, keep Passwordless account off

    In the same Additional security section, check that Passwordless account is OFF before you turn this on. Passwordless sign-in — using just a passkey, the app or a PIN — is convenient and can be secure, but it drops your password as a factor. Keeping a strong password and layering two-step on top means anyone trying to break in needs two separate things, which is harder to beat than a single passwordless method. You can always go passwordless later if you prefer.

    Some mail clients will need an app password

    Once two-step is on, any app that can’t handle a verification code — typically an older desktop or third-party mail client set up with basic IMAP/POP — will be blocked from your inbox until you create an app password and use it in that client in place of your normal password. Microsoft’s wizard flags this and links to it, and you can create one any time from the security page. Modern apps (the Outlook app, or Apple Mail set up fresh) use modern sign-in and won’t need one — so prefer those where you can.
    4

    Bank your recovery code

    Two-step needs an escape hatch for the day your authenticator disappears with your phone. Scroll to Recovery code and Generate a new code — Microsoft displays the 25-character code exactly once, so capture it now: printed and filed, or in your password manager's notes.

    It's strictly emergency-only and single-use — spending it means generating a replacement afterwards. It should never appear in a normal sign-in.
    Microsoft accountYour infoPrivacySecuritySubscriptionsDevices

    Additional security

    Passwordless account

    OFF

    Turn on

    Two-step verification

    OFF

    Turn on

    Sign out everywhere

    Sign out everywhere

    Recovery code

    You can use this code to access your account if you lose access to your sign-in info. Print this out and keep it in a safe place or take a picture of it.

    Generate a new code

    Generating and saving the 25-character Microsoft account recovery code

    5

    Replace the password with a real one

    The first lock on the door still matters. Expand Enter password, choose Change password, and set something 16+ characters long that exists nowhere else — reuse is how a breach at some forum you forgot about becomes an open Microsoft account. Don't compose or memorise it yourself: a password manager generates and autofills it. Proton Pass does this free, for every account you own, which makes 'long and unique everywhere' effortless rather than heroic.
    Microsoft accountYour infoPrivacySecuritySubscriptionsDevices
    Security

    Change password

    Last update: 4/24/2025

    Change ›

    Two-step verification

    ON

    Manage ›

    Ways to prove who you are

    Manage sign-in and verification options for your Microsoft account.

    Enter password Up to date
    Email a codeyourname@outlook.com Up to date
    Enter a code from an authenticator app Up to date

    account.microsoft.com Security, Change password, entering a strong new password and saving

    We recommend Proton Pass

    Generate and remember a long, unique password for every account — free, open-source, and end-to-end encrypted.

    Set up Proton Pass
    6

    Trim the sign-in methods to two good ones

    Finish in Ways to prove who you are. The target: exactly two strong methods — the authenticator app for daily use, and Email a code pointed at a secure address you control on a different provider, which is both your backup entrance and where Microsoft sends unusual-activity warnings.

    Then remove Text a code if it's present: SMS is the interceptable, SIM-swappable weak link, and with two better methods in place it's pure liability — expand it and choose Remove.
    Microsoft accountYour infoPrivacySecuritySubscriptionsDevices
    Security

    Change password

    Last update: 4/24/2025

    Change ›

    Two-step verification

    ON

    Manage ›

    Ways to prove who you are

    Manage sign-in and verification options for your Microsoft account.

    Enter password Up to date
    Text a code+•• ••• ••67 Up to date
    Enter a code from an authenticator app Up to date
    + Add a new way to sign in or verify

    Ways to prove who you are page, expanding the Text a code (SMS) method and removing it, leaving the authenticator and recovery email

    Can't remove it?

    Microsoft won’t let you remove a method if it would leave you with too few ways to prove who you are. If Remove is greyed out or blocked, add another method first — your recovery email is ideal — then remove Text a code.

    We recommend Proton Mail

    Your recovery pathway is only as secure as the email it's attached to. For maximum security, we recommend an end-to-end encrypted inbox.

    Why switch to Proton Mail

    Frequently asked questions

    What's the safest second step?
    An authenticator app, comfortably — codes are made on the device itself, so a SIM swap gets nothing. Email codes make a fine backup; treat texted codes as the last resort you've already removed.
    What happens if my phone and authenticator vanish together?
    That's the job of the recovery code and your backup email. The 25-character code stored somewhere safe, or a code sent to your recovery address, gets you back in without the app.
    With two-step on, does the password still matter?
    Yes — it's layer one of two, not decoration. A long, unique, manager-generated password means the second layer is a backstop, never the only thing holding.
    Will two-step break my email apps or Xbox sign-in?
    Anything modern — the Outlook app, current mail clients, Xbox — handles it natively. Only ancient apps demand an 'app password', and since those bypass two-step entirely, replacing the app beats creating one.

    What to do next

    Go further: an inbox that's private by default

    The account is now hard to break into — but the inbox inside it still sits on servers Microsoft can read, attached to the biggest target on the internet. An end-to-end encrypted mailbox like Proton Mail is the structural upgrade: only you can read your mail, and recovery runs through channels you control.
    Why switch to Proton Mail

    Worried you're already compromised?

    Hardening stops the next break-in; it doesn't reveal a past one. If there's any chance someone's already been inside, run the ten-check sweep — it surfaces planted rules, aliases, app passwords, connected apps and unfamiliar devices.
    See the signs of compromise

    Locking down other accounts?

    The same hardening logic fits any inbox — here's the provider-agnostic version.
    Secure any email account

    Was this guide helpful?

    Know someone who needs this? Send them the guide.

    JD

    Written by

    Jordan Dickson

    Founder, CyberSecurityGuides

    Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.

    Reviewed by CSG Security Engineers

    More from Device Security

    No image

    How to Recover Your Microsoft Account After Being Hacked

    How to get back into a hacked Microsoft account — the sign-in you use for Windows, Xbox, Office and Outlook — and what to do straight after.

    No image

    How to Tell If Your Microsoft Account Has Been Compromised

    Quick checks to confirm whether someone else has been inside the Microsoft account behind your PC, Xbox and inbox — and how to close every foothold.

    No image

    How to Recover Your Google Account After Being Hacked

    Three ways back into a hacked Google account — your Android's settings, a signed-in Google app, or full account recovery — and how to lock it down after.