Start with email: make your sign-in harder to hijack

Start with the most important account

Email is often used to recover other accounts. We therefore recommend starting there, followed by your password manager and accounts with administrator privileges.

Choose the right method

Microsoft describes passkeys as phishing-resistant because they are bound to the service's domain. Ordinary one-time codes and approval prompts do not have the same property. Check which options your service and devices support. [1, 2]

A manageable start

• Enable a passkey or another appropriate form of MFA on your most important account.
• Arrange a backup method following the service's guidance and keep recovery codes secure.
• Test a new sign-in and check your recovery information.
• Reject unexpected sign-in requests. If unsure, contact support through a known channel.

Your checkmarks are stored only in this browser.

For businesses

Our recommendation: start with a pilot group. Decide how to verify identity when someone loses their phone. Use separate administrator accounts and check that protection is actually used. Adapt deployment to your environment and licences.

Verify the result

Check that the intended method is used and that an authorised user can recover access without the usual device. Both registration and working recovery need to be part of the process.