Is there a separate Xbox 2FA setting?

No. Xbox signs in with your Microsoft account, and two-step verification is set on that account at account.microsoft.com. Turning it on there protects your Xbox account together with Outlook, OneDrive and everything else on the same account.

Do I have to use Microsoft Authenticator?

No. Microsoft pushes its own app during setup, but “Set up a different Authenticator app” accepts any app that generates standard codes. The Authenticator extension generates them in Chrome on your computer and reads the QR code straight off the Microsoft page — no phone needed.

What if I lose access to my authenticator?

Verify with another method on the account — a backup email address or a passkey — or use your recovery code, then set the authenticator up again. With two-step verification on, a password alone will not get you back in, and recovery can take 30 days, so keep the recovery code and the extension’s automatic backups.

My Xbox 360 says my password is incorrect after I turned on two-step verification.

Some devices, such as an Xbox 360, cannot ask for a code. For those, create an app password in the Microsoft account’s additional security options and use it instead of your normal password.

Xbox Authenticator App — Set Up 2FA on Your Microsoft Account

Your gamertag, your digital games, Game Pass and the payment details on the account all belong to the Microsoft account you sign in to Xbox with — the same one behind Outlook, OneDrive and Windows, so a stolen password opens every one of them. With two-step verification on, whoever signs in also needs the six-digit code only your device can produce. Microsoft is phasing out text messages for personal accounts, which leaves an authenticator app one of the main ways to prove it is you.

Turn on two-step verification for the Microsoft account behind your Xbox

With two-step verification on, you always need two forms of identification — lose one and your password alone will not get you back in, and regaining access can take 30 days. Microsoft recommends having three pieces of security info on the account, such as a backup email address, before you turn it on.

Sign in at account.microsoft.com/security on your computer with the Microsoft account you use on Xbox.
Click “Manage how I sign in” to see the ways you prove who you are.
Click “Add a new way to sign in or verify” and choose “Use an app”.
Microsoft offers its own Microsoft Authenticator. Instead, click “Set up a different Authenticator app” and then “Next”.
Microsoft shows a QR code. Leave it on the screen and add it to the extension as described below — or click “I can't scan the bar code” to see a code for manual entry — then enter the code from the extension.
Back on “Manage how I sign in”, under “Additional security” → “Two-step verification”, choose “Turn on” and follow the instructions on the screen.

Xbox’s own instructions

Add Xbox to Authenticator

Install 2FA Authenticator from the Chrome Web Store and pin it to the toolbar, so its icon is one click away.
Leave the Microsoft account page with the QR code open. Click the Authenticator icon, then “Add Account” → “QR Code” → “Scan QR from screen”.
The account appears in the list with a six-digit code that changes every 30 seconds. Rename it to Xbox if you like — the name is only for you.
Go back to the Microsoft page and type the current code into the confirmation field. If it is about to expire, wait for the next one.
Microsoft confirms the app is added. From now on, when signing in to Xbox asks for a code, click the extension icon and copy it.

No QR code, or it will not scan? Click “I can't scan the bar code” on Microsoft’s setup screen, copy the code, and add it in the extension with “Add Account” → “Manual” → “Secret Key”.

Get 2FA Authenticator for Chrome — free

Generate your Microsoft recovery code

On the same “Manage how I sign in” page, scroll to “Recovery code” and click “Generate a new code”. There is only ever one: generating a new code cancels the previous one, and Microsoft cannot show or download an existing code again. Print it and keep it away from any device you sign in with. If you lose your other methods, the sign-in page asks “Do you have an account recovery code?” — though with two-step verification on, changes can take 30 days to take effect.

The code is not accepted?

Most often the QR code changed: the website makes a new one each time its setup page is reloaded or opened again, so the account you added first no longer matches. Start the setup again, add the QR code that is on the screen now and type its code in straight away. Two entries for the same website? Use the newest. Other reasons: why codes are refused.

Typed the key in by hand? Paste it into the TOTP code generator and compare the code with the one in the extension. If they differ, the key was copied wrong — add the account again.

Questions

Is there a separate Xbox 2FA setting?: No. Xbox signs in with your Microsoft account, and two-step verification is set on that account at account.microsoft.com. Turning it on there protects your Xbox account together with Outlook, OneDrive and everything else on the same account.
Do I have to use Microsoft Authenticator?: No. Microsoft pushes its own app during setup, but “Set up a different Authenticator app” accepts any app that generates standard codes. The Authenticator extension generates them in Chrome on your computer and reads the QR code straight off the Microsoft page — no phone needed.
What if I lose access to my authenticator?: Verify with another method on the account — a backup email address or a passkey — or use your recovery code, then set the authenticator up again. With two-step verification on, a password alone will not get you back in, and recovery can take 30 days, so keep the recovery code and the extension’s automatic backups.
My Xbox 360 says my password is incorrect after I turned on two-step verification.: Some devices, such as an Xbox 360, cannot ask for a code. For those, create an app password in the Microsoft account’s additional security options and use it instead of your normal password.

Your codes, one click from the login page

Authenticator keeps your 2FA codes in the browser, on your device only — free to use, open source, no account and no phone needed. Local backups and optional password protection come built in.