Every console and app at once
Xbox Support treats two-step as an account setting that applies to all the devices, consoles and apps you use. Turn it on once and your Series X|S, the PC Xbox app and your phone are all behind it.
Xbox 2FA
How to enable 2FA on Xbox: Microsoft two-step verification, step by step
There is no two-step switch in your Xbox settings. Your gamertag sits on a Microsoft account, so Xbox 2FA means turning on Microsoft’s two-step verification in a web browser. Below are the exact menus, the methods worth adding now that Microsoft is retiring text codes, the recovery code almost nobody prints, and what changes the next time you sign in on a Series X|S, an Xbox One or an old Xbox 360.
Last checked against official sources on November 1, 2026.
Xbox two-step verification at a glance
Each row links to the Microsoft or Xbox support page it comes from.
- Where to switch it on
- account.microsoft.com/security, then Manage how I sign in, then Turn on under Two-step verification. Source
- Ways to verify
- An email address, an authenticator app such as Microsoft Authenticator, or a passkey (face, fingerprint or device PIN). Up to 10 in total. Source
- Text message codes
- Being phased out for sign-in and recovery on personal Microsoft accounts, in favor of passkeys and a verified email. Source
- When you get asked for a code
- Every time you sign in on a device that isn’t trusted. With two-step off, Microsoft only checks when something looks risky. Source
- Recovery code
- A 25-digit code you generate yourself. Each new code cancels the last, and Microsoft can’t show you an existing one again. Source
- Xbox Series X|S and Xbox One
- A passwordless account signs in through Use another device: enter the console’s code on the microsoft.com link page. Source
- Xbox 360
- Can’t ask for a security code, so once two-step is on it needs an app password instead of your normal one. Source
How to turn on two-step verification for Xbox
Step 1
Find the email behind your gamertag
Xbox Support says it can’t tell you this, even if you know your gamertag. Try signing in at xbox.com with the address you think it is: if it works, your gamertag shows in the top-right corner.
Step 2
Add backup ways to verify first
At account.microsoft.com/security, select Manage how I sign in, then Add a new way to sign in or verify. Add a second email you can always open and, if your phone or PC supports it, a passkey under Face, Fingerprint, PIN, or Security Key.
Step 3
Set up Microsoft Authenticator
Choose Use an app on the security page. In Authenticator, tap the plus icon, pick Personal account and Scan a QR Code. If the camera won’t scan, select I can’t scan the bar code on your PC and enter the code manually.
Step 4
Switch two-step verification on
Find Two-step verification under Additional security, select Turn on and follow the prompts. Microsoft shows a QR code during setup as one way to confirm the phone is physically yours.
Step 5
Generate the recovery code and print it
Scroll to Recovery code and select Generate a new code. Microsoft says to print it and keep it off any device you sign in with. A newer code cancels this one, so only the latest printout counts.
Step 6
Sign back in on the console and set a PIN
When your Xbox asks you to verify, use Authenticator or your email. Then press the Xbox button, open Profile & system > Settings > Account > Sign-in, security & PIN > Change my sign-in & security preferences, and pick No barriers, Ask for my PIN, Lock it down or Custom.
What two-step verification covers on Xbox
A leaked password stops short
Even if someone finds your password, Microsoft says they are stopped without your security info. That matters for anyone who has typed their password on a friend’s console.
Less typing on the TV
With a passwordless account, Xbox One and Series X|S let you approve sign-in from your phone instead of spelling out a password with a controller while the room watches.
Which methods to add now that SMS is fading
Microsoft strongly recommends keeping three pieces of security info. With two-step on you always need two forms of identification, so a password plus one method leaves you no spare.
Text messages are on the way out. Microsoft is phasing out SMS for sign-in and recovery on personal accounts, calling it vulnerable to phishing and SIM-swap attacks, and adding a new phone number may not even be offered. If an old number is your only backup, replace it:
- Microsoft Authenticator. Codes or approvals on your phone. Microsoft notes an authenticator app still lets you verify when the phone is offline.
- A passkey. Your face, fingerprint or device PIN. Microsoft calls passkeys phish-resistant: they can’t be guessed or stolen like a password.
- A second email. It doesn’t have to be yours, only one you can open. Microsoft suggests a partner or family member for emergencies.
What changes on your Xbox after you turn it on
Microsoft asks for a code whenever you sign in on a device it doesn’t trust yet, so expect a prompt when you add your profile to a new console, a friend’s Xbox or a replacement for a broken one.
Xbox 360 is the exception. It can’t show a code prompt, so after you turn on two-step it calls your password wrong even when it isn’t. Create an app password under App passwords in Advanced security options, type it on the 360 instead, and tick Remember me. Xbox says its own 360 help is no longer maintained.
The console has its own lock too. A forgotten Xbox PIN falls back to your Microsoft password, and Xbox warns that anyone in your family group who knows that password can reset your PIN. Lost or sold a console? You can’t remove your profile from it remotely, but changing your Microsoft password cuts it off.
The recovery code: print it before you need it
Microsoft’s 25-digit recovery code gets you back in if you forget your password or the account is compromised. Microsoft can’t retrieve an existing code, so if the printout is gone, generate a new one while you can still sign in.
To use it, choose Other ways to sign in, then Use my password, Forgot password?, Use a different verification option and I don’t have any of these. Type the code at the recovery code prompt. It isn’t case-sensitive, and spaces and dashes are optional.
One catch: with two-step on, Microsoft says changes made this way take 30 days to take effect. Three working methods beat leaning on the code.
Switching phones without locking yourself out
Move your codes while the old phone still works. Authenticator backups only restore to the same kind of phone. On Android, turn on Cloud Backup in Authenticator’s settings; Microsoft says Android backups move to Google One from January 2027. On iPhone, the backup uses iCloud Drive, iCloud Keychain and iCloud Backup. If your account signs in passwordless through Authenticator, only the account name comes back and you sign in again.
If the old phone is lost or replaced, remove its sign-in method under Security > Advanced security options. Lost every method? A password reset needs two contact methods while two-step is on, and Microsoft’s support agents can’t send reset links or change account details. That is when the recovery code and Microsoft’s recovery form come in.
Minecraft uses the same Microsoft account
Minecraft Help says you need a Microsoft account to sign in to Minecraft, and for two-step verification it points you to Microsoft’s own pages. There is no separate Minecraft setting to hunt for: turn on two-step for your gamertag and Java, Bedrock and your Realms are covered too.
What to keep on your Xbox vault card
Xbox Support can’t look up your Microsoft email from a gamertag, so keep that link yourself. In LoginScout, each encrypted card holds a login, notes and authenticator codes. A useful Xbox card has:
- The Microsoft account email and your gamertag, side by side.
- Which methods are on, which phone runs Authenticator, and where your passkey is saved.
- The date of your current recovery code and where the printout is kept, not the code itself.
- Every console your profile is saved on, so you know what to cut off if one goes missing.
More Xbox and Microsoft account help
Recover a hacked Xbox account When someone else changed the password or security info. Minecraft account security Java and Bedrock sign-in, Realms, PSN links and Minecraft scams. Recover a hacked Minecraft account The same Microsoft account, with Minecraft-specific checks. Minecraft account recovery Finding the right Microsoft login and filling in the recovery form. Backup codes on every platform Where each gaming platform keeps its recovery and backup codes. Gamertag generator Ideas for a new Xbox gamertag.
Questions people ask
How do I turn on 2FA for my Xbox account?
In a browser, sign in at account.microsoft.com/security with the Microsoft account your gamertag uses. Select Manage how I sign in, then Turn on under Two-step verification. It covers your consoles, PC and phone at once.
Can I use Microsoft Authenticator with Xbox?
Yes. Choose Use an app under Add a new way to sign in or verify, then scan the QR code in Authenticator with Personal account selected. Microsoft says any authenticator app works, so Google Authenticator is fine too.
Why does my Xbox 360 say my password is wrong after turning on 2FA?
The 360 can’t ask for a security code, so it rejects your normal password once two-step is on. Create an app password in Advanced security options, enter it on the console and tick Remember me.
Where do I find my Microsoft recovery code?
You generate it: Manage how I sign in, Recovery code, Generate a new code. Microsoft can’t show you an old code, and each new one cancels the previous one, so print it the moment it appears.
Does Xbox two-step verification also protect Minecraft?
Yes, if Minecraft is on the same Microsoft account. Minecraft signs in with that account and has no two-step setting of its own.
Can LoginScout recover my Xbox account if I lose my phone?
No. Only Microsoft can restore access to a Microsoft account. LoginScout keeps your account email, gamertag and notes on your verification methods in one encrypted place, so Microsoft’s recovery steps are easier to get through.
Sources
Checked against these official pages on November 1, 2026. Platforms change their settings and menus often. If something here no longer matches what you see, email [email protected] and we will fix the page. LoginScout is independent and not affiliated with the companies named here.
- Microsoft: How to use two-step verification with your Microsoft account (support.microsoft.com)
- Microsoft: Security info and verification codes (support.microsoft.com)
- Microsoft: How to add your accounts to Microsoft Authenticator (support.microsoft.com)
- Microsoft: Back up your accounts in Microsoft Authenticator (support.microsoft.com)
- Microsoft: How to get a Microsoft account recovery code (support.microsoft.com)
- Microsoft: Microsoft to stop sending SMS codes for personal accounts (support.microsoft.com)
- Microsoft: Create and save a passkey (support.microsoft.com)
- Microsoft: How to go passwordless with your Microsoft account (support.microsoft.com)
- Microsoft: How to get and use app passwords (support.microsoft.com)
- Xbox Support: Turn off two-step verification (support.xbox.com)
- Xbox Support: App password for the Xbox 360 (support.xbox.com)
- Xbox Support: Change sign-in preferences on your Xbox console (support.xbox.com)
- Xbox Support: Manage a PIN for your Xbox profile (support.xbox.com)
- Xbox Support: Add or remove an Xbox profile (support.xbox.com)
- Xbox Support: Find your Microsoft account email address (support.xbox.com)
- Minecraft Help: Account security and passwords for your Microsoft account (help.minecraft.net)
Related guides
Account security for every game Account security hubs for Fortnite, Roblox, Minecraft, Valorant and more. All guides Every LoginScout guide, from game signups to 2FA setup. How to enable 2FA on PS5 and PSN Step-by-step 2FA setup, checked against the platform’s help pages. 2FA code generator Generate TOTP codes from a setup key, right in the browser.
Keep the identity with the login.
Create a free vault, then upgrade for a private temp mailbox and burner numbers when the library grows.