Multi-factor authentication, or MFA, means a second check besides your password. It matters because passwords leak. If someone gets yours - from a phishing email, or from a breach at some unrelated website where you used the same one - MFA is the thing that stops them reading your mail and sending invoices in your name. It is the single most useful security step a small business can take, and it takes five minutes to set up.

What you need

Your work computer, your mobile phone, and five uninterrupted minutes. Do not start this on the way out the door.

Try this first: the Authenticator app

The Microsoft Authenticator app is the method we recommend. It is faster than typing a code, and it is harder for anyone to intercept than a text message.

1. On your phone, open the App Store (iPhone) or Google Play (Android) and install Microsoft Authenticator. It is free and published by Microsoft. Check the publisher name, because there are copycat apps.
2. On your computer, go to aka.ms/mfasetup and sign in with your work email address. If you have just been asked for More information required when signing in, click Next and you will land in the same place.
3. Choose Add sign-in method, then Authenticator app, then Next until a square black-and-white code appears on the screen.
4. On your phone, open Authenticator, tap the + in the corner, choose Work or school account, then Scan a QR code. Point the phone at the code on your screen. Allow the camera and notifications when the phone asks.
5. The computer sends a test. Your phone will show a notification with a two-digit number on the computer screen that you type into the phone. This is called number matching, and it exists so you cannot approve a sign-in by tapping without looking.
6. Once the test passes, the account appears in the app and you are done.

Add a second method as well

Do this now, not later. It is the difference between fixing a problem yourself and waiting for us.

1. Back on the same page, choose Add sign-in method again and pick Phone.
2. Enter your mobile number and choose to receive a code by text message.
3. Enter the code that arrives to confirm it.

Text message is the fallback, not the main method - codes by text can be intercepted in ways an app notification cannot. But having it registered means that if your phone is lost, replaced or flat, you can still get in and still reset your own password.

What it looks like day to day

You will not be asked every time. On a computer you use regularly, Microsoft usually asks once and then trusts that computer for a while. Tick Don’t ask again for 60 days or Stay signed in when it offers, on your own work devices only. Never tick it on a shared or public computer.

One rule that matters

If a prompt appears on your phone and you were not signing in to anything, do not approve it. Tap deny, then tell us. It means somebody has your password and is trying to get past the second check by hoping you tap without thinking. We can see where the attempt came from and change your password before it becomes a problem.

Still stuck?

Log a ticket at portal.yougrowit.com.au or email support@yougrowit.com.au. If it is stopping you working right now, call 03 9028 4358.

Support hours are Monday to Friday, 8:30am to 5:30pm Melbourne time, excluding Victorian public holidays.

Not a client yet?

This help centre is free to read and we would rather you fixed it yourself. If it has not worked, or you would rather someone just dealt with it:

The first call is free. Tell us what’s happening and we’ll tell you what we think it is, what fixing it involves, and what it’ll cost — before anything is charged. If it turns out to be a five-minute thing, we’ll usually just sort it out on the call.

Call 03 9028 4358 or email admin@yougrowit.com.au. Melbourne small businesses, Monday to Friday 8:30am–5:30pm. We don’t do home computers.