Extra sign-in steps

On the sign-in page you then see a second step titled Confirm it is you with the lead Your account asks for a second step. The page adds This is an extra step you turned on. It adds a check, but it does not make your sign-in two-factor. The emailed code is eight digits.

The section states the limits itself: Neither counts as two-factor verification: they do not replace a passkey or an authenticator app where one is required, and they do not count as a second factor when you recover your account.

Each card repeats the point for its own step.

• A password as a second step adds an extra step. It does not make your sign-in stronger against someone who already knows your password.
• An emailed code adds an extra step. It does not make your sign-in stronger against someone who controls your mailbox, because the code goes to the same mailbox.

For real protection, use a passkey or an authenticator app.

You do not need a second factor to turn these on, since many people who want them have none. Instead the platform asks that your browser has been used with the account for 24 hours. From a newer browser the section shows This browser is new to your account and says to use a browser you already sign in from, or to come back after this one has been used for a day. A browser becomes known only through a sign-in that proved more than the password (a passkey, an authenticator code, or a link or code emailed to you); a password alone never does, so sign in once with an emailed link or code and come back after a day. A security notice goes to your verified addresses when a step is turned on or off.

On the Security overview, a step that is offered or on appears as a row, Password as a second step or Emailed code as a second step, with On or Off.

Select Turn off on its card and confirm in the dialog.

• For the password step the dialog is Stop asking for your password as a second step? After an email link or a linked account you are no longer asked for your password. The page says Your password is no longer asked as a second step.
• For the emailed code the dialog is Stop emailing a code as a second step? After your password you are no longer asked for an emailed code. The page says A code is no longer emailed as a second step.

See Password for the password itself.

With a step on, you sign in with the first method and then the step. If you cannot finish it, for example because you forgot the password, see Signing in for the options the sign-in page offers.

An account that an organization manages (a managed identity) cannot add, change or remove its own sign-in methods here: those requests are refused with Your organization manages this account, so this is not available here. Ask your organization’s administrator., because the organization's directory connection is its only way in.

• Authenticator app
• Passkeys
• Signing in