Set up two-step verification
Check enabled/disabled status and enroll an authenticator only through the supported identity flow.
For: Business · Staff · Independent Professional. Open: Security → Account security → Two-step verification.
Enrollment steps
- Read Authenticator enabled, Authenticator disabled or Unable to check authenticator status. Reload for unknown status.
- When available, select Set up authenticator and sign in again. Select Set up an authenticator after signing in.
- Scan the QR code with your authenticator. On the same phone use Can’t scan? Enter a setup key / Copy setup key, then manual Time-based setup in the authenticator.
- Return, enter Authenticator code and select Verify code.
- Finish, return to Security and check enabled status. Save recovery codes privately when offered.
Supported state and limits
Current tenant UI describes this enrollment as optional. Older text requiring every Business login is superseded by current source. A specific provider or assurance-protected action may still request verification. Authenticator setup is explicitly unavailable in the local Auth Emulator and its button is disabled with a reason; do not treat the screenshot as successful enrollment.
A setup QR/key is secret. Do not publish it or confuse it with a recovery code. Subsequent protected sign-ins need the current six-digit app code. Cancel verification ends the attempt; expired attempts require another sign-in. Losing the authenticator requires legitimate recovery, not sharing an owner account.