Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To add a backup sign-in method to a Microsoft work or school account, open https://aka.ms/MySecurityInfo, sign in, choose Add sign-in method (sometimes shown as Add method), select a method your organization permits, and complete its verification. Test the new method while your current method still works, then keep both registered. Microsoft Authenticator, a passkey, or a FIDO2 security key can provide a stronger backup than text messages when your tenant allows them.
If you cannot see the add option, the organization may restrict self-service registration or require an administrator-led recovery, such as a Temporary Access Pass. In that situation, contact your Microsoft 365 or Microsoft Entra administrator or help desk rather than deleting the method you still have.
How do I add a second MFA method to my Microsoft work account?
Use the account’s Security info page. The labels and available methods are controlled by your organization’s Microsoft Entra policies, so your screen may not show every option described here.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Open https://aka.ms/MySecurityInfo and authenticate with your work or school account. You can also reach the same area through MyAccount > Security info.
- Select Add sign-in method. Some tenants display the button as Add method.
- Choose a permitted method, such as Microsoft Authenticator, phone (SMS or voice where enabled), a passkey, or a FIDO2 security key.
- Follow the method-specific prompts. Depending on the choice, you may need to scan a QR code, approve number matching, create a PIN, or complete a biometric check.
- Finish the registration and perform a test sign-in with the new method. Leave your original method available during this test.
- After the replacement works, keep two working methods where policy permits. Remove an old or lost method only after that check succeeds.
The page may ask you to reauthenticate before showing or changing methods. That is expected: the security-information page is where you manage authentication registrations, not merely profile contact details.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Which backup authentication methods can I add?
The useful choice depends on whether you need a method independent of your phone, resistance to phishing, easy portability, or the broadest policy compatibility. The table describes the capabilities established for each method; a tenant can disable any of them.
| Method | How it works | Security and recovery characteristics | Important limits |
|---|---|---|---|
| Microsoft Authenticator | Push approval, one-time verification codes, passwordless phone sign-in, or a passkey in the app | Supports several sign-in modes and is available on Android and iOS. It can be a practical second method when you have a separate, functioning phone. | The work-account registration still has to be completed on a replacement phone; restoring app data alone does not make the registration active. |
| FIDO2 security key | A physical USB, NFC, or other supported security key completes a cryptographic sign-in | Microsoft identifies FIDO2 keys as phishing-resistant and encourages them as a strong method. The key is independent of a lost phone. | You must carry the key and use a model and connection type accepted by your devices and tenant. Specific compatibility and pricing are not stated here. |
| Passkey | A device-bound or credential-manager-synced cryptographic credential, unlocked with the device’s PIN or biometric | Passkeys are phishing-resistant and can be convenient on a replacement device when the credential manager supports synchronization. | A passkey on a new phone may still need a separate registration. Tenant policy determines whether passkeys appear. |
| Phone SMS or voice | A code or call is sent to an administrator-approved number | Can provide a basic fallback when enabled and usable. | Only appears when the tenant permits it; the administrator controls the phone method and number. SMS is less resistant to phishing and phone-number takeover than a security key or passkey. |
| Email address used in the administrator’s self-service password-reset workflow | May help recover a password in that workflow. | It is not used as the MFA authentication method in the described Microsoft administrator workflow. |
When is Microsoft Authenticator the right backup?
Authenticator is a flexible choice if you can keep a second phone available or if your organization already standardizes on it. Push notifications are convenient, while the app’s verification-code mode can help when push delivery is unavailable. Number matching and the phone’s PIN or biometric prompt add checks against accidental approvals.
Authenticator is not a substitute for an independent recovery path if the only copy is on the phone you might lose. Register a FIDO2 key or passkey as well when your policy allows it and your threat model justifies the extra setup.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →When should I choose a FIDO2 key or passkey?
Choose a FIDO2 key when you want a physical backup that does not depend on cellular service, the old phone, or an app restore. A passkey provides similar phishing resistance and may be easier to use if your devices or credential manager support it. Microsoft specifically encourages FIDO2 keys, passkeys, and Windows Hello for Business as strong methods, but the tenant must expose those choices.
How do I set up Microsoft Authenticator on a new phone?
Plan the change while the old phone still works. A restored account name in Authenticator is not the same as a completed Microsoft Entra registration; the work account requires an additional sign-in and setup step on the new device.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Before you erase or trade in the old phone
- Open Authenticator on the old phone and enable its backup feature in the app’s settings.
- Confirm that the backup has completed according to the app’s status. Keep the old phone powered and connected until you have tested the replacement.
- On the new phone, install Microsoft Authenticator from the official app store for Android or iOS.
- Use the app’s Add account option, choose Work or school account, and restore the available backup or follow the sign-in prompts.
- Return to the Security info page if prompted. Complete the account sign-in, QR-code scan, number matching, PIN, or biometric verification requested by your tenant.
- Start a fresh sign-in to a work resource and approve it on the new phone. Only after that succeeds should you retire the old registration or wipe the old device.
Backup can restore the account entry, but it does not guarantee that an active work-account credential is restored. Treat the new phone as an unregistered device until the sign-in test proves otherwise.
What if passkeys are required?
If your organization enforces passkeys, add a new passkey on the replacement phone before removing the old one. A passkey synchronized by a credential manager may appear on the new device, while a device-bound passkey generally has to be registered again. Use Add sign-in method in Security info to complete that registration, then test it in a new sign-in.
What should I do if I lost the phone with Microsoft Authenticator?
Your next step depends on whether another registered method still works. Do not rely on Authenticator backup alone if the old phone is gone; an administrator may need to reset the registration.
If another method is available
- At the sign-in prompt, select Sign in another way or the equivalent option.
- Use your registered security key, passkey, phone method, or another method that the tenant offers.
- Once signed in, open Security info and select Add sign-in method.
- Register Authenticator on the replacement phone, or register a new FIDO2 key or passkey.
- Complete a test sign-in. Then remove the lost phone’s Authenticator entry so it can no longer approve requests.
If no registered method works
Contact your organization’s Microsoft 365 or Microsoft Entra administrator or help desk. The approved recovery may involve an administrator-issued Temporary Access Pass, a forced MFA re-registration, a password reset, session revocation, or another process defined by the tenant. Identity administrators can add or change methods for users, but a user cannot bypass a policy-enforced lockout from the sign-in page.
Give the help desk enough information to identify the account and explain that the Authenticator device is unavailable. Do not send one-time codes or approve an unexpected prompt while waiting for assistance.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How should I compare backup methods?
Security strength is only one criterion. A method is useful as a backup when it remains available during the failure you are planning for, can be registered under your tenant’s policy, and can be tested without first deleting your primary method.
| Decision question | FIDO2 key or passkey | Authenticator | SMS or voice |
|---|---|---|---|
| Resists phishing? | Strong; Microsoft classifies FIDO2 and passkeys as phishing-resistant methods. | Stronger than SMS when number matching and code protections are used, but push approval can still be abused if a user approves an unexpected request. | Weakest of these choices against phishing and phone-number takeover. |
| Independent of a lost phone? | Yes for a separate FIDO2 key; a passkey is independent only if it is available on another device or credential manager. | No if the only registration is on the missing phone. | Usually depends on continued control of the administrator-approved phone number. |
| Setup friction | Requires registering and carrying a key, or creating a passkey on each needed device. | Requires installing the app and completing account verification. | Usually quick when the tenant permits it. |
| Portability | A key travels separately; a device-bound passkey may not. | Moves with a phone after a restore and fresh registration. | Follows the approved number, subject to carrier access. |
| Policy support | Only appears when enabled by the tenant and supported by the sign-in policy. | Commonly offered, but still controlled by tenant settings. | Appears only when administrators enable SMS or voice. |
| Can it be tested before deleting the old method? | Yes; register it, sign in once, and leave the old method in place during the test. | Yes; approve a new sign-in while the old phone or method remains active. | Yes; request a code while the existing method is still registered. |
For most users, two different failure domains are safer than two copies of the same dependency: for example, Authenticator plus a FIDO2 key, or a passkey on a replacement-capable device plus a separate key. Your organization’s rules may limit that design.
Why can I not see “Add sign-in method”?
Missing controls usually reflect policy rather than a broken browser. Microsoft Entra authentication-method settings and Conditional Access policies determine which methods are displayed and whether self-service registration succeeds.
- The method is disabled: An administrator may have turned off SMS, voice, passkeys, security keys, or Authenticator for the tenant or for your group.
- Registration is restricted: Conditional Access may require a compliant device, a trusted network, or an administrator-assisted enrollment.
- You are in the wrong account: Confirm that the browser session uses the work or school account, not a personal Microsoft account.
- Your account is mid-recovery: An administrator may have forced MFA re-registration or applied a Temporary Access Pass requirement.
- The page is being reached through an old bookmark: Return to https://aka.ms/MySecurityInfo and sign in again.
If the control remains unavailable, ask the help desk which methods your account is allowed to register and whether they must issue a recovery credential. Do not repeatedly remove and re-add methods; that can leave you with fewer usable options.
How do I test a backup method without locking myself out?
Test the new registration before changing anything that already works. A controlled test confirms both enrollment and the actual sign-in path used by your organization’s applications.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Leave the original method registered and physically available.
- Open a private browser window or sign out of a noncritical work application.
- Start a new sign-in with the work account and choose the newly added method when prompted. If the prompt defaults to another method, use Sign in another way.
- Complete the key touch, passkey unlock, Authenticator approval or code, or phone verification as appropriate.
- Confirm that the application opens and that the sign-in appears in your normal account activity or security notifications.
- Repeat once from a second browser or device if your work policy uses different Conditional Access rules for managed and unmanaged devices.
If the test fails, keep the old method. Check that the phone has the correct date and time, that notifications are enabled for Authenticator, that the security key is connected or tapped as required, and that the passkey is available on the device being used. Policy errors, rather than a local device fault, require administrator help.
When is it safe to remove an old authentication method?
Remove a method only after the replacement has completed a real sign-in and you have another working fallback. This is especially important for a phone that has been lost, recycled, or handed to another person.
- Register and test the replacement method.
- Verify that at least one additional method remains usable under your tenant’s policy.
- In Security info, locate the retired entry and choose its remove or delete action.
- Confirm the deletion and perform one more sign-in using the replacement.
Deleting a method can invalidate pending approvals and may trigger re-registration requirements. If the method belongs to a device you no longer control, remove it promptly after you have established another route, or ask an administrator to remove it if self-service is blocked.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What can an administrator do when self-service recovery fails?
Users can normally manage their own registrations in Security info, but administrators control the policy boundaries and can recover accounts that cannot complete self-service. An Authentication Administrator can add or change methods, reset passwords, require MFA re-registration, revoke sessions, and remove methods for users.
Administrators also decide which authentication methods are enabled and which groups or applications can use them. They may issue a Temporary Access Pass or follow a separate identity-verification procedure before allowing a new Authenticator, passkey, or security key to be enrolled. The exact process is organization-specific, so follow the help desk’s verification instructions rather than attempting to work around them.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
What are the most common setup mistakes?
- Deleting first: Removing the old phone before testing the new method creates an avoidable lockout.
- Assuming a restore equals registration: Authenticator backup can restore an account entry while the work account still needs sign-in and verification.
- Using only one dependency: Two registrations on the same lost phone do not provide independent recovery.
- Expecting every method to appear: Tenant and Conditional Access policies can hide methods entirely.
- Treating email as MFA: Email may support self-service password reset but is not the MFA method in the described administrator workflow.
- Ignoring number matching or prompts: Approve only a sign-in you initiated and verify the displayed number when Authenticator requests it.
- Failing to update a retired device: A lost phone’s registration should be removed after a replacement is confirmed, so it cannot remain an approval path.
What is the safest practical setup for most employees?
Register Authenticator for everyday convenience and add a phishing-resistant method that does not rely on the same phone, such as a FIDO2 security key or an allowed passkey. Test both while they are registered, keep recovery instructions from your organization’s help desk, and update the registrations whenever you replace a phone or change devices. Microsoft does not impose a universal two-method minimum in Entra ID, but it recommends that organizations encourage at least two strong methods to reduce lockouts when one is lost or deleted.
Frequently Asked Questions
Does Microsoft require every work account to have exactly two authentication methods?
No universal Entra ID rule requires exactly two methods for every tenant. Your organization can impose its own minimum or allowed-method policy, while Microsoft recommends encouraging at least two strong methods to reduce lockouts.
Will restoring Authenticator from backup automatically approve work sign-ins on my new phone?
No. The account entry may return in the app, but a work or school account still needs a sign-in and registration step on the replacement phone. Complete that setup from Security info and perform a real sign-in test.
Can an administrator remove the Authenticator registration from my lost phone?
Yes. An Authentication Administrator can remove methods, revoke sessions, or require MFA re-registration for a user. Contact the organization’s help desk if you cannot reach Security info with another method.
Why does my organization offer a security key but not SMS?
Authentication-method availability is controlled by tenant and Conditional Access policy. Administrators may disable SMS or voice and expose only methods that meet their security requirements, such as FIDO2 keys, passkeys, or Authenticator.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
