How to Enable MFA and Passkeys (Google, Apple, Microsoft)

A password alone is not enough. Stolen credentials still power most account takeovers, and “change your password” does nothing if the attacker already has the old one. Multi-factor authentication (MFA) — still often called two-factor authentication or 2FA — adds a second check: something you have (phone, security key, passkey) or something you are (Face ID / fingerprint), not just something you know.

This guide modernizes the old “turn on 2FA” checklist for how people actually sign in now: passkeys, authenticator apps, and platform MFA across Google, Apple, and Microsoft. Skip the vague pep talks — here are the concrete switches. Pair this with a password manager habit from our social-login memory guide and email hygiene in protecting email from hackers.

What MFA actually is in 2026

MFA means the service asks for a second factor after (or instead of) a password. Common factors:

• Passkeys — phishing-resistant keys stored in iCloud Keychain, Google Password Manager, or a hardware key. You unlock with Face ID, fingerprint, or PIN.
• Authenticator apps — time-based one-time codes (TOTP) from Google Authenticator, Microsoft Authenticator, Authy, 1Password, etc.
• Push approvals — “Was this you?” prompts in Microsoft Authenticator, Google prompts, or Apple device approvals.
• SMS / voice codes — better than nothing, weaker than apps or passkeys (SIM-swap risk). Use only if nothing else is available.
• Hardware security keys — YubiKey-style USB/NFC/Lightning keys for high-value accounts.

Passkeys vs authenticator apps vs SMS

Prefer this order when the account offers choices: passkey or security key → authenticator / push → SMS. Passkeys defeat classic phishing pages that steal codes. Authenticator apps still beat SMS. SMS is a last resort for accounts that refuse better options.

You do not have to pick only one forever. Many accounts let you add a passkey and keep an authenticator as backup. Do that for email and banking first — those unlock everything else.

Turn on MFA for Google

On the web: open Google Account → Security. Under “How you sign in to Google,” set up:

1. Passkeys and security keys — create a passkey on this device or phone.
2. 2-Step Verification — if not already on, turn it on; add Google prompts and/or an authenticator app.
3. Authenticator app — scan the QR with your chosen app; store backup codes somewhere offline.
4. Review Your devices and signed-in sessions; sign out anything you do not recognize.

On Android or iPhone, the same Security page opens in the Google app or browser. Work/school accounts may force organization MFA — follow your admin’s method.

Turn on MFA for Apple ID

Apple calls it two-factor authentication for your Apple ID. On iPhone/iPad: Settings → [your name] → Sign-In & Security (wording varies slightly by iOS version). Turn on two-factor if it is not already required, and confirm trusted phone numbers.

New sign-ins on a new device get a six-digit code on a trusted Apple device. Keep at least two trusted devices or a trusted number you control. For iCloud.com and appleid.apple.com, use the same Apple ID with MFA — do not disable it to “make logins easier.”

Passkeys for third-party sites live in Passwords / iCloud Keychain. That is separate from Apple ID MFA, but both belong in a modern lock-down.

Turn on MFA for Microsoft

For personal Microsoft accounts: go to account.microsoft.com/security → advanced security options. Enable two-step verification, then add:

• Microsoft Authenticator (push + codes) — preferred for Microsoft IDs.
• An alternate authenticator via QR if you standardize on one app family.
• A passkey / security key where offered.
• Backup email or phone only as recovery — not as your only daily factor.

Work or school (Entra ID / Microsoft 365) MFA is controlled by your org. Use the Authenticator method your admin requires; register a second method before travel.

Pick and back up an authenticator app

Pick one primary authenticator and stick to it so you are not hunting five apps during a lockout:

• Microsoft Authenticator or Google Authenticator — simple and free.
• 1Password / Bitwarden / Dashlane — codes next to the password vault (great if you already pay for a manager).
• Authy — multi-device backup if you accept their cloud model; enable its own protection PIN.

When you scan a new QR, immediately save the recovery / backup codes the site shows. Screenshot-to-camera-roll is weak; a printed page in a safe place or an encrypted note is better. Export or cloud-backup your authenticator if the app supports encrypted transfer — test restore once before you need it.

Recovery codes and what to do if you lose your phone

Lost phone checklist:

1. Use a recovery code from your password manager or paper list to sign in on a computer.
2. Remove the old phone as a trusted device; add the new phone’s passkey / authenticator.
3. If you have no codes and no second factor, use the provider’s account recovery flow (Google, Apple, Microsoft each have identity checks). Expect delays — that friction is the point.
4. Rotate the password and revoke app passwords / sessions after you are back in.

Never share live codes with “support” callers or chat pop-ups. Real vendors will not cold-call you asking for MFA digits.

FAQs