Multifactor authentication adds a further check to a sign-in, so knowing a password is not necessarily enough to enter an account. Providers may support authenticator applications, security keys, device-based methods or codes sent by message. The right setup includes both the protection used today and a way to recover access if the device holding that protection is lost.
Prioritise the important accounts
Begin with the account that receives password-reset emails, then cloud storage, device accounts and any administrator account. For work systems, follow the methods required by your organisation. If several people administer a service, give them individual authorised accounts where supported; one shared login tied to one person's phone makes both responsibility and recovery harder to manage.
Write down what each account currently requires for sign-in. This is an access inventory, not a collection of secret codes. Note whether recovery uses an email address, a second device or provider-generated backup codes. An old phone number in that inventory is a practical issue to fix before it becomes your only route back in.
Understand the method you choose
CISA identifies phishing-resistant MFA as the strongest target for organisations and describes supported FIDO/WebAuthn approaches. Other forms of MFA can still improve protection, but methods differ in how they handle deceptive sign-in pages and unexpected approval requests. Check the provider's current official guidance instead of assuming that every option with “two-step” in its name offers identical protection.
When choosing, consider the devices you actually carry and the accounts you must access while travelling. A security key may need a compatible connection. An authenticator application may need a separate migration or backup procedure. Test the method with a normal sign-in before declaring setup complete, and confirm which recovery options the service permits.
Put recovery somewhere independent
If backup codes are provided, keep them in a protected location that does not rely solely on the phone or account they recover. A printed copy stored securely may suit some households; a protected vault accessible through another authorised route may suit others. Do not place a photograph of the codes in an openly shared album.
A second supported method can provide resilience, but only if you protect it and know where it is. Label a spare security key by purpose without writing secret account information on it. Check that adding it did not accidentally remove the original method. Recovery arrangements should be understandable to the account owner without being readily available to strangers.
Rehearse a phone change
Before disposing of your old phone, confirm your essential accounts work on the new device. Follow each provider's migration instructions and test sign-in independently. Do not assume transferring all applications also transfers every authenticator credential. Keep the old device until the relevant checks succeed, then remove its account access and erase it using supported procedures.
For a small team, document who can recover an administrator account and how their identity will be checked. A colleague should not need to search a former employee's personal messages to keep the organisation operating. Changes in staff are a useful trigger to review both access and recovery ownership.
Respond carefully to unexpected approvals
If an approval request appears when you are not signing in, reject it and investigate through the service's known security settings. Do not approve repeated requests just to stop the notifications. Contact your workplace support team promptly if the account belongs to your organisation, and follow the service's official account-security process for personal accounts.
MFA setup is complete when a normal sign-in works, the recovery route is protected and tested, and obsolete methods have been removed. Keep reviewing those three points when devices, phone numbers or account owners change.
Sources and further reading
This original guide was prepared with AI assistance. Examples are illustrative. The edition date is an assigned date in this 2026 catalogue. See our editorial policy and report a correction.