Stillcode › Two-factor authentication › Microsoft Account
Microsoft Account publishes software of its own for this and also takes an open authenticator code. What choosing either one commits you to, and what happens when the phone holding those codes is gone.
These are the second factors Microsoft Account offers on teams.live.com. Which ones you
see can depend on your plan and your country;
what each of the seven actually costs you is set out once.
| Method | What it is | |
|---|---|---|
| Authenticator app (TOTP) | Supported | Computed on your own device; nothing is sent to produce it. |
| The service’s own app | Supported | Software this service publishes; it works, and only here. |
| SMS text message | Supported | Texted to your number, so your carrier is part of the lock. |
| Supported | Sent to your mailbox, which then sets the ceiling. | |
| Hardware security key | Not offered | A physical key you tap; the one option phishing does not beat. |
Microsoft Account's own caveat, as recorded in the directory: 2FA phone calls may not be available in all regions.
Data sourced from 2FA Directory by 2factorauth. Snapshot 2026-09-24.
Microsoft Account offers both SMS and an authenticator app. They are not equivalent — a texted code depends on your mobile carrier and survives no longer than control of your phone number, while a generated code never travels. If both are enabled, the account is only as strong as the weaker one, because an attacker picks.
There is an email fallback, which quietly makes this account as protected as the mailbox behind it. If that mailbox has weaker two-factor than this account does, the weaker one is the real setting.
Microsoft Account also offers a prompt through software it publishes itself. It works, and it works only here: an account secured that way ties you to that software on whatever device you happen to be holding, which is the trade-off an open standard like TOTP exists to avoid.
Of the fifty services on this site, nine publish software of their own as a second factor,
and Microsoft Account is one of them. Two of the fifty accept exactly this combination, so the same
decision comes up on one other
service here. Among the five services filed under communication,
one accepts a hardware security key —
Microsoft Account not among them.
The directory files Microsoft Account under communication, records four of the seven second
factors it tracks, and points at instructions published at
support.microsoft.com/help/12408. That host is worth a second look: it is not teams.live.com, which is the
address the same record gives for Microsoft Account itself.
Microsoft Account is teams.live.com, and the same account also signs you in at
skype.com. Two-factor authentication
is a property of the account, not of the address you happened to type — switch it on once
and every one of those is covered. That also means losing the second factor loses all of them at
once.
Microsoft Account's own instructions: Microsoft Account — two-factor authentication — linked, never copied, because a stale menu path here locks people out.
Microsoft Account publishes no dedicated page for losing your second factor, which in practice means the route back is ordinary account recovery: proving who you are to support, on their timetable.
Background: how the codes work · what still works when the phone is gone.
An iPhone, iPad and Mac authenticator for these codes that makes no network calls at all. What is free and what Pro adds. Get it on the App Store