Microsoft 365: sign in with your phone or a security key

Sign in more safely – without typing a password

You can use your phone or a small security key to sign in to your Microsoft 365 account. You confirm with your fingerprint, face or a PIN.

This is called a passkey. It helps you avoid fake sign-in pages that try to steal your password. You need both to have the phone or key and to be able to unlock it. [1, 7]

Phone or security key – choose what suits you

With your phone: You use Microsoft Authenticator, an app on your phone. When you sign in, you confirm using your phone.

With a security key: You use a small physical key that plugs into your computer's USB port. Some models can also be held against a phone, rather like tapping a payment card. Both the phone and the key must support this. [2, 3, 6]

We recommend your phone for daily use and a separate security key as a backup. This gives you a way in even if your phone breaks or is lost. The backup key must have been added to the account and tested beforehand.

Check these things first

This guide covers your Microsoft 365 work or school account. IT must have enabled the sign-in method. Menus can look slightly different depending on your phone, computer and organisational settings. [3]

1. Your phone needs a screen lock, an updated Authenticator app and at least Android 14 or iOS 17.
2. If you choose a physical key, it must be a FIDO2 security key allowed by your organisation, with a connection that fits your device. An ordinary USB storage drive will not do.
3. You need to be able to sign in with your current method when adding the new one. Keep it until the new method and backup access have been tested.

Phone: set it up once

Already having codes or approval prompts in Authenticator does not mean a passkey has been created. Add one as follows. [4]

1. Open Microsoft Authenticator on your phone and tap your work or school account.
2. Select Create a passkey. If the account is not in the app, add a work or school account and select Sign in.
3. Sign in and verify your identity using your current method.
4. Follow the app's instructions. Select Authenticator as a passkey provider in your phone settings if asked. Then return to the app and finish.
5. Check that you receive confirmation that the passkey was added. If the option is missing, ask IT to check your account settings.

Phone: how to sign in on your computer

Keep your phone near the computer and enable Bluetooth and internet on both. Only use a QR code from a sign-in you started yourself. [5]

1. Open your organisation's usual Microsoft 365 sign-in on the computer.
2. If necessary, select Other ways to sign in or Sign-in options, followed by Face, fingerprint, PIN or security key.
3. Choose a phone or another device so that a QR code appears on the computer.
4. Scan the code with your phone's normal camera. Open the passkey sign-in and select the correct account if asked.
5. Confirm with your face, fingerprint or phone unlock method. The computer now signs in to the account.

Want to sign in on the phone itself?

Open the service in a supported mobile browser. Choose passkey sign-in, select the saved key for your work account and confirm using your phone's unlock method. You do not need a QR code on another screen. Support varies between browsers and apps. If the option does not work, ask IT which browser to use. [5]

Security key: set it up once

You register the key with your account. This is not about copying files onto it. [2, 9]

1. Enter https://mysignins.microsoft.com/security-info in your browser and sign in using your current method.
2. Select Add sign-in method, then Passkey or Security key, depending on what is shown.
3. Select Security key. If the computer suggests something else, first select Use another device or More options.
4. Connect the key by USB or use NFC if supported. Follow the instructions to set or enter the key's PIN and touch the key if asked.
5. Give the key a clear name, such as Work key, and finish registration.

Security key: how to sign in

The key's PIN unlocks the key. It is not your Microsoft 365 account password. Enter it in the computer's or browser's security dialog. [6]

1. Open Microsoft 365 and, if necessary, select Sign-in options or Other ways to sign in.
2. Select Face, fingerprint, PIN or security key, followed by Security key.
3. Connect the key by USB or hold it against the NFC reader where supported. Enter the key's PIN or use its fingerprint reader. Touch the key if asked.
4. Check that you reached the correct account. Then look after the key as you would other important keys.

Test it and arrange a backup

Do not remove old sign-in methods just because registration succeeded. First test that the new method actually lets you in. We recommend also having a separately registered backup key. [2, 10]

1. Open a private browser window on a trusted computer. Sign in with the new method and check the correct account. An already signed-in tab is not a sufficient test.
2. Register the backup key separately and test it too. Keep it in a different secure place from your phone or everyday key.
3. Also test Outlook, Teams and other work apps. Ask IT for help before any old methods are removed.

Lost your phone or replacing it?

If something is lost, use your backup key if you have one and contact IT through a known channel. IT needs to remove the lost method from the account and assess whether anything else is needed. Without a working backup, IT can help you regain access after verifying your identity, for example with a temporary access code if organisational rules allow it. [8, 9]

1. When replacing your phone, create and test a passkey on the new phone before wiping the old one. Do not assume the passkey in Authenticator will transfer with an ordinary app backup. [1]
2. Do not give a PIN or temporary access code to someone who calls you. Do not reset the security key at random; this can also erase its sign-in credentials for other services. [9]

Stuck? Start here

Do not disable sign-in protection to solve a registration problem. [2, 3, 5]

1. Option missing: ask IT to check that your account is allowed to use passkeys.
2. QR sign-in fails: check Bluetooth, internet and that the phone is near the computer. Also check that the passkey belongs to the correct account.
3. Wrong device shown: select Use another device or More options to find the right phone or security key.
4. Unsure: contact your organisation's IT team or RoxIT through a contact route you already know.

For the person responsible for company IT

Registering a passkey does not automatically require it for every sign-in. IT needs to plan which methods are allowed and required. Start with a small group, check that the intended method is used and test recovery before tightening requirements. Passkeys are available in Entra ID Free; Conditional Access rules require at least Entra ID P1. Maintain working emergency access and a plan to reverse the policy change. [7, 10, 11] Continue keeping devices updated and permissions limited.