📱 Set up MFA (number matching)

You keep using your password, and add a second check: a prompt in Microsoft Authenticator where you type a two-digit number shown on the sign-in screen.

A strong step up, but not the strongest

Number matching is far safer than a text-message code or a plain "Approve" prompt. If you can, a passkey is better again - it cannot be used on a fake sign-in page at all.

How number matching works

You enter your username and password as normal.
The sign-in screen displays a two-digit number.
Microsoft Authenticator sends a notification to your phone.
You type that same number into the app and confirm with Face ID, fingerprint or PIN.

Because you have to read the number from the screen in front of you, you cannot approve a sign-in someone else started by tapping a prompt without thinking. That is what makes it meaningfully safer than an older "Approve / Deny" push.

If a number prompt appears unexpectedly

Do not enter the number. Select No, it's not me and tell your IT support team - it means someone else has your password.

Can I use a third-party authenticator app?

Partly. Apps such as Google Authenticator, Authy or 1Password can generate the standard six-digit code (TOTP), and that works with Microsoft 365. But the number matching push notification is specific to Microsoft Authenticator - other apps cannot receive it. If your organisation expects push approval with number matching, install Microsoft Authenticator.

What you need

Your work username and password
A smartphone with Microsoft Authenticator installed
About five minutes

Start MFA setup

Back to Auth Guide

Need help? Contact your IT support team.