Do I have to use Microsoft Authenticator?

No. Microsoft pushes its own app during setup, but “Set up a different Authenticator app” accepts any app that generates standard codes. The Authenticator extension generates them in Chrome on your computer and reads the QR code straight off the Microsoft page.

What if I lose access to my authenticator?

Verify with another method on the account — a backup email address or a passkey — or use your recovery code, then set the authenticator up again. With two-step verification on, a password alone will not get you back in, and recovery can take 30 days, so keep the recovery code and the extension’s automatic backups.

An app says my password is incorrect after I turned on two-step verification.

Some apps and devices — the mail apps on some phones, or an Xbox 360 — cannot ask for a code. For those, create an app password in the account’s additional security options and use it instead of your normal password.

Why can’t I add a phone number for text message codes?

Microsoft is phasing out SMS as a sign-in and recovery method for personal accounts, so the option may not appear at all. An authenticator app, a passkey or a backup email address are what it offers instead.

Microsoft Account Authenticator App on PC

One Microsoft account signs you in to Outlook.com, OneDrive, Xbox, Microsoft 365 and Windows itself, so a stolen password opens all of them. Microsoft is phasing out text messages as a sign-in and recovery method for personal accounts, which makes an authenticator app one of the main ways left to verify it is you — and it works even when the device is offline.

Turn on two-step verification for your Microsoft account

With two-step verification on, you always need two forms of identification — lose one and your password alone will not get you back in, and regaining access can take 30 days. Microsoft recommends having three pieces of security info on the account, such as a backup email address, before you turn it on.

Sign in at account.microsoft.com/security on your computer.
Click “Manage how I sign in” to see the ways you prove who you are.
Click “Add a new way to sign in or verify” and choose “Use an app”.
Microsoft offers its own Microsoft Authenticator. Instead, click “Set up a different Authenticator app” and then “Next”.
Microsoft shows a QR code. Leave it on the screen and add it to the extension as described below — or click “I can't scan the bar code” to see a code for manual entry — then enter the code from the extension.
Back on “Manage how I sign in”, under “Additional security” → “Two-step verification”, choose “Turn on” and follow the instructions on the screen.

Microsoft’s own instructions

Add Microsoft to Authenticator

Install 2FA Authenticator from the Chrome Web Store and pin it to the toolbar, so its icon is one click away.
Leave the Microsoft page with the QR code open. Click the Authenticator icon, then “Add Account” → “QR Code” → “Scan QR from screen”.
The account appears in the list with a six-digit code that changes every 30 seconds. Rename it if you like — the name is only for you.
Go back to Microsoft and type the current code into the confirmation field. If it is about to expire, wait for the next one.
Microsoft confirms that two-factor authentication is on. From now on it will ask for a code when you sign in — click the extension icon and copy it.

No QR code, or it will not scan? Look for the option to enter a key manually on Microsoft’s setup screen, copy the key, and add it in the extension with “Add Account” → “Manual” → “Secret Key”.

Get 2FA Authenticator for Chrome — free

Generate your Microsoft recovery code

On the same “Manage how I sign in” page, scroll to “Recovery code” and click “Generate a new code”. There is only ever one: generating a new code cancels the previous one, and Microsoft cannot show or download an existing code again. Print it and keep it away from any device you sign in with. If you lose your other methods, the sign-in page asks “Do you have an account recovery code?” — though with two-step verification on, changes can take 30 days to take effect.

The code is not accepted?

Almost always the computer’s clock. The codes are calculated from the current time, so a clock that is a minute off produces codes that look right and are refused. Turn on automatic date and time in your system settings — step-by-step for Windows, macOS and Linux.

If the clock is right, check the key itself: paste it into the TOTP code generator and compare the code with the one in the extension. If they differ, the key was copied wrong — add the account again.

Questions

Do I have to use Microsoft Authenticator?: No. Microsoft pushes its own app during setup, but “Set up a different Authenticator app” accepts any app that generates standard codes. The Authenticator extension generates them in Chrome on your computer and reads the QR code straight off the Microsoft page.
What if I lose access to my authenticator?: Verify with another method on the account — a backup email address or a passkey — or use your recovery code, then set the authenticator up again. With two-step verification on, a password alone will not get you back in, and recovery can take 30 days, so keep the recovery code and the extension’s automatic backups.
An app says my password is incorrect after I turned on two-step verification.: Some apps and devices — the mail apps on some phones, or an Xbox 360 — cannot ask for a code. For those, create an app password in the account’s additional security options and use it instead of your normal password.
Why can’t I add a phone number for text message codes?: Microsoft is phasing out SMS as a sign-in and recovery method for personal accounts, so the option may not appear at all. An authenticator app, a passkey or a backup email address are what it offers instead.

Your codes, one click from the login page

Authenticator keeps your 2FA codes in the browser, on your device only — free, open source, no account and no phone needed. Local backups and optional password protection come built in.