Skip to main content

Second Authentication Factor

A security mechanism that adds an additional layer of protection to the login process. In addition to the password, it is necessary to confirm the identity using a second element, such as a temporary code, a notification in an application or another secure method.

The two-factor authentication (2FA) significantly reduces the risk of unauthorized access because even if the password is compromised, the attacker won't be able to access the account without the second factor. 2FA is one of the most effective ways of protecting sensitive information and preventing computer attacks.

Create a second authentication factor with a mobile phone

To add a second authentication factor (2FA) on your mobile phone (Android, iPhone, or even iPad) to your Microsoft 365 profile:

  1. Install Microsoft Authenticator on your Android or iPhone/iPad mobile phone;
  2. Go to the security area of your Microsoft profile (regular authentication);
  3. Add a new sign-in method;
  4. Choose Microsoft Authenticator;
  5. Proceed with the remaining steps.

If you prefer, watch the video on the 2FA registration process.

If, in the above procedures, you validated the 2FA you created using the digits you were asked for, you are done, and the 2FA is registered.


See the instructions below if you don't want to install an app on your mobile phone.

Test the second authentication factor

In the voluntary 2FA registration phase, not all Microsoft applications ask for the second factor. At this stage you can test it by accessing Azure:

  • Log in to the Azure portal to be prompted for the 2nd factor;

In the mandatory phase for second factor, you will be asked for it the first time you access any Microsoft 365 tool. In the Teams and OneDrive applications, you may be immediately prompted to re-authenticate using 2FA.

Create a second authentication factor without a mobile phone

  1. Install the desired application on your computer (we suggest 2FAGuard for Windows, the native Passwords application for Mac, or Authenticator for Linux);
  2. Go to the security area of your Microsoft profile (normal authentication);
  3. Add a new sign-in method;
  4. Choose Microsoft Authenticator;
  5. Indicate that you want to "use a different authentication application";
  6. Proceed with the remaining steps.

If you wish, you can see the previous steps in more detail, applied to 2FAGuard for Windows.

Important Note: we do not recommend using the 2FA application on the same computer as the 2FA application, as this makes the procedure less secure.


One of the safeguards of 2FA is to separate it as much as possible from the first one, so using a different device is preferable (e.g. a mobile phone). See Microsoft's explanation of why Microsoft Authenticator is unavailable for PC or Mac. See also the last FAQ, I can't use my mobile phone, nor do I have another computer to use the second factor application. How can I use the second factor?.

Frequently Asked Questions (FAQ)

Multiple factors can determine the frequency of 2FA re-authentication, such as changing passwords, computers, applications, etc.
If you work on the same computer every day and the computer is registered in the AD U.Porto, managed by UPdigital, authentication on Microsoft Teams, OneDrive, and Edge will be requested again within a window of up to 90 days. The frequency will increase if these conditions are not met.
Microsoft has more information on re-authentication prompts and session lifetime for Microsoft Entra multifactor authentication.

If there is a problem with your mobile phone/computer, this backup allows you to reconfigure 2FA on your own without having to call the HelpDesk.

Yes. You can configure Microsoft Authenticator on your mobile phone and an application on the desktop at the same time. At any time, you can access the security area of your Microsoft 365 profile and check/add/remove the devices you have associated with carrying out 2FA on your account.

You can install another application with TOTP support, such as Google Authenticator. You must follow the process of Create a second authentication factor without a mobile phone, using the TOTP application installed on your mobile phone.

If you haven't made a backup, contact the HelpDesk so that you can reset the 2FA associated with your account. After the reset, you should configure 2FA again according to the instructions above. Please note that this reset may take a few hours to take effect.

If you haven't made a backup, contact the HelpDesk so that you can reset the 2FA associated with your account. After the reset, you should configure 2FA again according to the instructions above. Please note that this reset may take a few hours to take effect.

You don't need to change it. The 2FA will work as before.

In the authentication process, select ‘I cannot use my Microsoft Authenticator application at this time’.

2FA FAQ 01

Choose ‘Use a verification code’ and enter the code generated by the application.

2FA FAQ 02

Yes. Configuration is possible on both computers. You can configure them as different devices or export the authentication from one application and import it into the other.

2FA, mobile phone or application, works without being connected to the internet. You don't need anything other than your mobile phone or application on your computer. See the answer from Microsoft regarding sign in responses.

This is a common error. Click ‘Continue’ and the authentication process should be complete.

2FA FAQ 03

Yes, you can have 2FA configured on both accounts. With Microsoft Authenticator, the validated code is the one currently being verified for the account being accessed.

You need to go to your profile, security area and ‘Add sign-in method’. Once you have completed the steps, you can delete the registration associated with the mobile phone you want to remove.
Never remove 2FA authentication on a device without having at least one other already configured.

Yes, you can register several devices for 2FA authentication. Go to your profile, security area and do ‘Add sign-in method’ to register other authentication methods, which can be a second mobile phone or another application that supports 2FA authentication.

As mentioned above, the advantage of using the second factor is to have it separate from the first factor (the password). We therefore advise against using the 2FA application on the same computer.

However, the existence of the second factor is an added security factor compared to just the password. The suggested applications, once installed, require a password to be accessed, i.e. they have extra protection when logging into the computer. It is therefore preferable to use the 2FA application on the same computer where the second factor will be requested, rather than not using the second factor at all.

If your question still hasn't been answered, see also Microsoft's questions and answers about Authenticator.
Suggestions:

Over there see also the menu on the right where you'll find more information about using Microsoft Authenticator.
If you still have problems, you can also send an email to [email protected].