Small Town Sysadmin
Free CJIS checklist

Tech basicsUpdated October 15, 2026

Turn on two-step sign-in: the one setting that stops most account takeovers

What two-step sign-in is, why it matters, and how to turn it on for Google, Microsoft 365, and your bank, in plain English.

Passwords get stolen all the time, through scam emails, data breaches at other companies, or simple guessing. Two-step sign-in (also called two-factor or multi-factor authentication) means a stolen password isn’t enough: whoever signs in also needs a second proof that it’s really you, usually a code or a tap on your phone.

If you do one thing to protect your office this week, make it this.

How it works day to day

You sign in with your password as usual. Then your phone asks you to confirm: you tap Approve in an app, or type a six-digit code. On your own trusted computer, most services only ask every so often, not every single time.

Your options, from best to okay:

  • An authenticator app (like Microsoft Authenticator or Google Authenticator) on your phone. Strong, and it works without cell signal.
  • A security key, a small USB or tap-to-use device. The strongest option, great for bosses and anyone who handles money.
  • Text message codes. Better than nothing, but the weakest option, since scammers can sometimes redirect phone numbers.

Turn it on for Google (Gmail)

  1. Go to myaccount.google.com and click Security & sign-in.
  2. Click 2-Step Verification and follow the steps.
  3. Save your backup codes when Google offers them, somewhere safe that isn’t your email: printed in a locked drawer, or in a password manager.

If your office uses Google Workspace (Gmail with your own business address), whoever manages it can turn on the requirement for everyone in the Google Admin console under Security > Authentication > 2-Step Verification. Google recommends letting people enroll first, then turning on enforcement.

Turn it on for Microsoft 365 (Outlook with a work address)

For the whole office (the best way): Microsoft 365 includes a free setting called security defaults that turns on two-step sign-in for everyone at once. It’s available in every Microsoft 365 business subscription, and it has to be turned on by someone with admin access. If you don’t manage your own Microsoft 365, ask whoever does: “Are security defaults or MFA turned on for everyone?” Microsoft’s step-by-step guide is linked in the sources below.

For yourself: once it’s required, Microsoft walks you through setup the next time you sign in, usually by installing the Microsoft Authenticator app and scanning a code.

Turn it on for your bank

Nearly every bank offers it now. Look in your online banking under Security, Settings, or Profile. For business accounts, turn it on for every person who can log in or approve payments, not just the owner.

Don’t lock yourself out

  • Set it up on your admin or owner accounts first, and test it before rolling it out to everyone.
  • Save backup codes during setup. They’re your way back in if your phone is lost or replaced.
  • Getting a new phone? Move your authenticator app to the new phone before wiping the old one.

One warning

If you ever get a sign-in approval request or a code you didn’t ask for, don’t approve it and don’t read the code to anyone who calls. That means someone has your password. Deny it, then change that password right away.

Sources

All articles