Guides

How to Enable MFA on Google, Microsoft and AWS

By Ravindra Bagale, Cyber Security trainer · LinkedIn · Published: 29 September 2026 · Last updated: 30 September 2026

Turn on multi-factor authentication (MFA) so a stolen password alone cannot open the account. On Google use 2-Step Verification (authenticator or security key), on Microsoft use security defaults or per-user MFA in Entra ID, and on AWS assign an MFA device to the root user and to every IAM user you sign in with.

Google:   myaccount.google.com → Security → 2-Step Verification
Microsoft personal: account.microsoft.com → Security
Microsoft work: Entra ID → Users → Per-user MFA / Conditional Access
AWS root: console top-right → Security credentials → Assign MFA device
AWS IAM:  IAM → Users → Security credentials → Assign MFA device

What do I need before enabling MFA?

• Phone with an authenticator app (Google Authenticator, Microsoft Authenticator, Authy, or similar) or a FIDO2 security key.
• Access to the account email / recovery options already working.
• 15–20 minutes; print or store backup codes somewhere offline.

How does MFA stop account takeover?

1. Attacker steals or guesses only the password.
2. Sign-in still asks for a second factor you hold (code, push with number match, or security key).
3. Without that factor, the session should not open.
4. You get a chance to see unusual prompts and deny them.

Prefer phishing-resistant options (security keys / passkeys) when the product offers them. SMS works as a starting point but is weaker than an app or key.

How do I enable MFA on Google?

Step 1 — Open Google security settings

1. Sign in at myaccount.google.com.
2. Open Security.
3. Find 2-Step Verification and start enrollment.

Step 2 — Add a strong second factor

1. Choose Authenticator app and scan the QR code, or add a security key.
2. Confirm with a live code.
3. Save backup codes offline (not in the same inbox).
4. Optionally add a passkey for passwordless sign-in on trusted devices.

How do I enable MFA on Microsoft?

Step 1 — Personal Microsoft account

1. Sign in at account.microsoft.com.
2. Open Security → Advanced security options.
3. Turn on Two-step verification.
4. Register Microsoft Authenticator or another method and test sign-in.

Step 2 — Work or school (Microsoft Entra ID)

1. An admin enables Security defaults or a Conditional Access policy that requires MFA.
2. Each user completes registration at aka.ms/mfasetup (or the prompt at next sign-in).
3. Prefer Microsoft Authenticator with number matching over simple approve/deny pushes.
4. Admins should use stronger methods (phishing-resistant) for privileged roles.

How do I enable MFA on AWS?

Step 1 — Protect the root user first

1. Sign in as root.
2. Open the account menu (top right) → Security credentials.
3. Under Multi-factor authentication (MFA) choose Assign MFA device.
4. Pick authenticator app or hardware/passkey options supported in your region.
5. Enter two consecutive codes when asked.
6. Delete any root access keys on the same page.

Step 2 — Daily work as an IAM user with MFA

1. Create a group with only the permissions you need.
2. Create an IAM user with console access; add the user to that group.
3. Sign in at https://ACCOUNT_ID.signin.aws.amazon.com/console (not the root email page).
4. Assign MFA to that IAM user the same way.
5. Details and screenshots path: Create an IAM user with MFA.

Step 3 — Quick verify

1. Sign out and sign in again — MFA prompt must appear.
2. Confirm you still have backup / second device registered for recovery.
3. For AWS CLI long-term keys, prefer IAM roles on EC2 / SSO over permanent keys when you can.

How do I fix common MFA setup problems?

Ghabru naka 😅 — these are the usual ones: