Skip to main content
Securing your Microsoft 365 account isn’t optional — it’s the single most important thing you can do to protect your emails, documents, and personal data from unauthorised access. A compromised Microsoft account can expose your entire OneDrive, your inbox, your contacts, and every file you’ve ever shared. This guide walks you through every essential security and privacy setting you should configure, from enabling multi-factor authentication on day one to reviewing which third-party apps have access to your data.
Microsoft will never ask for your password or verification codes by email, phone, or chat. If anyone claiming to be Microsoft requests these details, it is a scam — do not share them.

​
Multi-Factor Authentication (MFA)

Multi-factor authentication is the most effective single security measure you can enable. Even if someone steals your password, MFA prevents them from signing in without a second verification step from your phone or authenticator app. Microsoft reports that MFA blocks over 99.9% of automated account attacks.

​
How to Enable MFA

You can set up MFA through My Account or directly via the Microsoft shortcut link:
1

Navigate to Security Info

Go to aka.ms/mfasetup in your browser and sign in with your Microsoft 365 account. Alternatively, visit account.microsoft.com, click Security, then Advanced security options.
2

Add a Sign-In Method

Under Two-step verification, click Turn on (personal accounts) or under Security info, click + Add method (work/school accounts). You’ll be prompted to choose a verification method.
3

Choose Your Verification Method

Select Authenticator app for the most secure and reliable option (see below). You can also choose Phone (SMS) or Email as a backup method — but avoid relying on SMS as your only method.
4

Set Up Microsoft Authenticator

Download the Microsoft Authenticator app on your iOS or Android device. In the app, tap + Add account, select Work or school account (or Personal account), then scan the QR code shown on screen.
5

Verify and Save

Complete the on-screen verification to confirm your new method works, then click Done. MFA is now active. The next time you sign in from a new device, you’ll be prompted to approve the request in the Authenticator app.

​
Authenticator App vs. SMS

Microsoft Authenticator App (Recommended)

Generates time-based one-time codes offline, supports push notification approval, and enables passwordless sign-in. More secure than SMS because it can’t be intercepted by SIM-swapping attacks.

SMS Text Message

Sends a 6-digit code to your phone number. Convenient and familiar, but vulnerable to SIM-swapping and phone number hijacking. Use as a backup method only, not as your primary MFA method.
Enable passwordless phone sign-in in the Microsoft Authenticator app to skip typing your password entirely. In the app, tap your account, then tap Enable phone sign-in. When you sign in, you’ll just approve a number match on your phone — no password needed.

​
Password Best Practices

Even with MFA enabled, a strong password is an important layer of defence. Follow these guidelines when setting or updating your Microsoft account password:
  • Use a passphrase — a string of four or more unrelated words (e.g. coffee-lantern-bridge-42) is both long and memorable
  • Make it unique — never reuse your Microsoft account password on any other site
  • Avoid obvious choices — do not use your name, birthdate, or common words like password or microsoft
  • Use a password manager — Microsoft Edge has a built-in password manager that saves, autofills, and checks your passwords for breaches. Access it at edge://password-manager/ or in Edge Settings > Passwords.

​
Enabling Passwordless Sign-In

If you want to go further, Microsoft supports fully passwordless authentication:
  1. Go to account.microsoft.com > Security > Advanced security options
  2. Under Passwordless account, click Turn on
  3. Follow the prompts to verify with Microsoft Authenticator
  4. Once enabled, you sign in using the Authenticator app, Windows Hello, or a security key — no password required

​
App Passwords

App passwords are one-time-use passwords generated for older applications — such as legacy email clients, third-party productivity tools, or older versions of Outlook — that do not support modern MFA sign-in flows. When you need an app password:
  • You’re using an email client that connects via IMAP/POP3 and doesn’t support OAuth 2.0
  • A business app prompts you for your Microsoft credentials but fails after you approve MFA
  • You’re integrating with a service that requires a stored username and password
How to generate an app password:
  1. Go to account.microsoft.com > Security > Advanced security options
  2. Scroll to App passwords and click Create a new app password
  3. Copy the generated password and paste it directly into the application — you won’t see it again
App passwords are only available if your account has two-step verification enabled. If your organisation manages your account, your admin may have disabled this feature — check with your IT department.

​
Reviewing Sign-In Activity

Regularly checking your recent sign-in history helps you catch unauthorised access early:
  1. Go to account.microsoft.com/security
  2. Click Review activity under the Sign-in activity section
  3. Browse the list of recent sign-ins — each entry shows the date, device type, browser, and approximate location
If you see a sign-in you don’t recognise, click This wasn’t me to immediately secure your account. Microsoft will prompt you to change your password and review your security settings.

​
Connected Apps and Permissions

Over time, you may grant third-party apps and services access to your Microsoft account. It’s good practice to review and remove any apps you no longer use:
  1. Go to account.microsoft.com/privacy
  2. Click App access (or navigate to account.microsoft.com/privacy/app-access)
  3. Review the list of apps that have access to your account data
  4. Click Remove these permissions next to any app you want to revoke
Removing permissions immediately cuts off that app’s access to your Microsoft account data, including any files or emails it may have been reading.

​
Privacy Settings

Microsoft gives you meaningful control over what data it collects and how it’s used.

​
Microsoft Privacy Dashboard

Your central hub for managing personal data is the Microsoft Privacy Dashboard:
  • Browse history — view and delete browsing data synced from Edge
  • Search history — view and clear your Bing search history
  • Location activity — see location data Microsoft has recorded and clear it
  • Cortana’s notebook — review information Cortana has learned about you
  • Health activity — manage data from Microsoft Health and fitness apps

​
Controlling Data Collection

To adjust what diagnostic data Microsoft collects from Windows and Microsoft 365:
  • On Windows: go to Settings > Privacy & security > Diagnostics & feedback and set the level to Required diagnostic data only
  • In Microsoft 365 apps: go to File > Options > Trust Center > Trust Center Settings > Privacy Options and review the connected experiences and diagnostic data settings

​
Managing Advertising ID and Personalised Ads

Microsoft uses an advertising ID to serve you personalised ads in some apps and services. To limit this:
  1. Go to account.microsoft.com/privacy/ad-settings
  2. Toggle off See personalised ads in your browser and See personalised ads in apps
You can also turn off the Windows Advertising ID at Settings > Privacy & security > General on Windows 10/11.

​
Frequently Asked Questions

Act immediately to limit the damage:
  1. If you can still sign in, go to account.microsoft.com/security and change your password right away.
  2. Review your Security info and remove any phone numbers, email addresses, or authenticator apps you don’t recognise — a hacker may have added their own.
  3. Check your Recent activity and click This wasn’t me on any suspicious sign-ins.
  4. Review your Outlook inbox rules and forwarding settings — attackers often set up auto-forwarding to steal emails silently.
  5. If you’re locked out, use Microsoft’s account recovery form to regain access.
  6. Once back in, enable MFA immediately if it wasn’t already active.
To remove a device:
  1. Go to account.microsoft.com/devices
  2. Find the device you want to remove and click on it
  3. Click Remove device — this signs the device out and revokes its access to your account
If the device is lost or stolen, also consider using Find My Device on the same page to locate or lock it before removing it.
Yes. Microsoft encrypts your OneDrive files both in transit (using TLS) and at rest (using AES-256 encryption). Each file is encrypted with its own unique key, adding an extra layer of protection.Microsoft 365 Business and Enterprise plans additionally support Customer Key, which lets your organisation supply and control the encryption keys used to protect your data at rest — giving you full ownership over access.
You can limit Microsoft 365 activity tracking in several ways:
  • Activity history (Windows): Go to Settings > Privacy & security > Activity history and uncheck Store my activity history on this device, then click Clear activity history.
  • Microsoft Search history: Visit account.microsoft.com/privacy > Search history > Clear all search history.
  • Microsoft 365 connected experiences: In any Office app, go to File > Options > Trust Center > Trust Center Settings > Privacy Options and disable optional connected experiences.
  • LinkedIn integration: If you don’t want LinkedIn profile data shown in Outlook or Teams, go to account.microsoft.com/privacy > LinkedIn and disconnect the integration.