What you'll do
- Before you start — what you need
- Download the Microsoft Authenticator app
- Open the app for the first time
- Add a work or school account
- Sign in with your work email
- Use your Temporary Access Pass instead of a password
- Finish device setup and verify the account is added
- Permissions you may be asked for
- Things that can go wrong (and how to fix them)
- Plain-English glossary
0 Before you start — what you need
Have these three things ready before you begin:
- Your work phone (or a personal phone you use for work) with internet (Wi‑Fi or mobile data).
- Your work email address (for example,
[email protected]). - Your Temporary Access Pass (TAP). This was sent to you by IT — usually by email, SMS, or read out over the phone. It looks like a long string of numbers and letters, e.g.
4a8b2c1d9e.
Important about your TAP
A Temporary Access Pass usually only works for a short period (often 1 hour up to 8 hours). If you wait too long, it will expire and IT will need to issue a new one. Try to complete this setup in one sitting.
What is a Temporary Access Pass?
A TAP is a one-time code that lets you sign in without a password just long enough to set up Microsoft Authenticator. After setup, you'll use the Authenticator app instead of a password from then on.
1 Download the Microsoft Authenticator app
If you've been given this guide on a printed page or on another screen, open your phone's camera and point it at the QR code below that matches your phone. Tap the link that pops up — it goes straight to the app store. If you're reading this on the same phone, just tap the link under the QR code instead.
Either way, you're installing Microsoft Authenticator — the one with this icon, made by Microsoft Corporation:
Make sure you get the right app
There are many apps called "Authenticator" in the app stores. The correct one is published by Microsoft Corporation and has a blue padlock with a person silhouette in front of it. Do not install Google Authenticator, Authy, or any "Authenticator Pro" — those won't work for our sign-in.
Tip if scanning the QR code doesn't work
Open the App Store (iPhone) or Play Store (Android) yourself, search for
Microsoft Authenticator, and look for the one published by Microsoft Corporation.
2 Open the app for the first time
Once it's installed, tap Open in the app store, or find the new Authenticator icon on your home screen and tap it.
On first open, the app will show you a few setup screens. This is what to expect — and what to tap:
2a. Privacy and terms
App screen
Microsoft respects your privacy
"We collect required diagnostic data to keep the app secure and updated. This does not include your name or any data you enter."
Accept
Tap Accept. You can't continue without accepting — this is just confirming that the app collects basic technical data (like crash reports), not your sign-ins.
2b. Optional diagnostic data
App screen
Help improve the app
Share non-personal usage data with Microsoft.
Continue
No thanks
Either choice is fine — it does not affect how the app works. Most people tap Continue.
2c. Notifications permission
iPhone prompt
Android prompt
"Authenticator" Would Like to Send You Notifications
Notifications may include alerts, sounds and icon badges. These can be configured in Settings.
Allow
Don't Allow
Allow Authenticator to send you notifications?
Allow
Don't allow
You MUST tap "Allow"
If you tap "Don't Allow", you will not see sign-in approval requests on your phone, and you won't be able to log in to your work account. If you accidentally tapped Don't Allow, see the troubleshooting section to switch it back on.
3 Add a work or school account
You should now be looking at the main Authenticator screen on your phone. It might say "You're all set up", "Ready to add your first account", or just show an empty list.
3a. Tap the plus sign
Tap the + button. On most phones it's in the top-right corner. On some Android phones it might say "Add account" in the middle of the screen instead.
3b. Choose the account type
App screen — "What kind of account are you adding?"
Personal account
For Microsoft accounts like Outlook.com, Hotmail, Xbox.
Work or school account
For accounts given to you by your employer or school.
Other (Google, Facebook, etc.)
Tap Work or school account.
Don't pick "Personal account"
Even if your work email looks like an Outlook or Hotmail address, you must choose Work or school account. Personal account is for sign-ins to Xbox, Skype, and personal Microsoft 365 — not your work account, and your TAP will not work there.
3c. Choose "Sign in" (not "Scan a QR code")
App screen — "Add work or school account"
Sign in
Use your work email and password (or Temporary Access Pass).
Scan a QR code
If your administrator gave you a QR code.
Tap Sign in. (If you only see one option that says "Scan a QR code", look for a small "Or sign in" link at the bottom of the screen.)
4 Sign in with your work email
The app will open a Microsoft sign-in page inside the app. It looks just like a normal Microsoft login page, but stays within Authenticator.
In-app sign-in page
Sign in
Email, phone, or Skype
Next
Type your full work email address (for example, [email protected]), then tap Next.
Use your work email — not your personal one
Your TAP only works with the email IT issued. Hotmail, Outlook.com, Gmail, iCloud, or any personal address will fail.
Phone keyboard tips
Turn off auto-capitalisation by checking the first letter — phones often capitalise "F" when you type your first name. Email addresses should be entirely lower-case. Long-press a key to see alternatives if needed.
5 Use your Temporary Access Pass instead of a password
After tapping Next, the app should automatically take you to the TAP entry screen, because IT has set up your account to use a TAP. You won't be asked for a password.
In-app sign-in page
Enter Temporary Access Pass
Use the Temporary Access Pass provided by your administrator to sign in.
Sign in
Carefully type the Temporary Access Pass from IT, then tap Sign in.
Typing the TAP carefully
- The TAP is usually not case-sensitive, but type it exactly as given to be safe.
- The number 0 and the letter O look similar — read carefully.
- The number 1, the letter l (lower-case L), and capital I can look identical.
- Don't include any spaces.
- If you copy-pasted from an email or text, watch out for an extra space at the start or end — tap into the field and use backspace to clean it up.
- If the password manager on your phone offers to autofill, ignore it — the TAP isn't saved there.
What if it asks for a password instead of a TAP?
If the screen says "Enter password" rather than "Enter Temporary Access Pass":
- Check you typed your work email correctly on the previous screen.
- Look for a small link saying "Use your Temporary Access Pass instead" — tap it.
- If neither helps, your TAP may have expired. Contact IT for a new one.
6 Finish device setup and verify the account is added
After your TAP is accepted, the app will quickly run through a few setup steps to register your phone with your work account. Here's what may pop up — and what to tap.
6a. "Set up your screen lock" (only if your phone doesn't have one)
App screen
Your organisation requires a screen lock
To protect your work account, your phone must have a screen lock (PIN, fingerprint, or Face ID).
Set up
If you see this, tap Set up — it will take you to your phone's settings. Add a PIN, fingerprint, or Face ID, then return to Authenticator.
Don't skip this
If you don't set a screen lock, you can't finish adding the account. Most workplaces require at least a 6-digit PIN.
6b. Confirm it's really you (face ID / fingerprint / PIN)
iPhone — Face ID prompt
Android — biometric prompt
Use Face ID to unlock Authenticator?
"Authenticator" wants to use Face ID to confirm sign-ins.
OK
Don't Allow
Verify it's you
Use your fingerprint to confirm.
Look at the phone (Face ID), touch the fingerprint sensor, or type your phone PIN. This is what protects your work account from anyone else who might pick up your phone.
Why this is happening
The app is "binding" you to this phone — locking the account so only someone who can unlock your phone (with your face, fingerprint, or PIN) can approve sign-ins.
6c. "Registering your device" / "Setting up"
You'll see a spinner or progress message for a few seconds while the app finalises everything. Don't close the app or lock your phone during this part.
6d. Account added — done!
Authenticator main screen
You should now see your account in the list on the Authenticator home screen, showing your work email. That means setup is complete.
Test it (recommended)
Lock your phone, then try signing in to
portal.office.com from any browser using your work email. When prompted, you should see an "Approve sign-in?" notification on your phone with a 2-digit number to enter. If that works, you're fully set up.
If you ever get an "Approve sign-in?" notification you didn't expect — tap "No, it's not me"
A notification you didn't ask for means someone is trying to sign in as you. Tap "No, it's not me" or Deny, then contact IT immediately.
About passwords
Many organisations using TAP are moving to passwordless sign-in — once Authenticator is set up, you may never need to type a password again. Some organisations will still ask you to set a permanent password as a backup; if a password reset prompt appears, follow it now while your TAP is still valid. Check with IT if unsure.
Permissions you may be asked for
Here is every permission prompt you might see during setup, and what to tap. Some of these only appear on certain phones or only the first time.
| Prompt | What to tap | What happens if you don't |
|---|---|---|
| Send you notifications | Allow | You will not get sign-in approval requests and cannot log in. |
| Access the camera (optional during this setup) | Either | Camera is only needed if you ever add a personal account by scanning a QR code in future. Not required for TAP-based work account setup. |
| Access location (Android only, optional) | Either | Some advanced security features won't work, but normal sign-in is unaffected. |
| Disable battery optimisation (Android) | Allow | Notifications may be slow or not arrive when your phone is idle. |
| Allow Authenticator to use Face ID / Touch ID (iPhone) | OK | You'll have to type your phone passcode every time instead. |
| Display over other apps (Android, rare) | Allow | Sign-in prompts may not appear on top of other apps. |
| Send diagnostic data to Microsoft | Either | No effect on you. |
| Back up to iCloud / Microsoft Account | Optional — see note | If you lose your phone, you'll have to ask IT to reset Authenticator from scratch. |
About cloud backup
The app may ask if you want to back up your accounts to your personal Microsoft Account or iCloud. Check with IT first — some workplaces require this to be off, others recommend it on. If unsure, leave it off; you can change it later in Authenticator → Settings → Backup.
? Things that can go wrong (and how to fix them)
"My TAP is not working / says invalid"
- Double-check you typed it correctly — no spaces, no extra characters.
- Confirm you used your work email, not personal.
- Check the time on the email IT sent you — TAPs typically expire after 1 hour by default. If it's been longer, ask IT for a new one.
- If you've already used the TAP once successfully, it may be a "single-use" TAP and won't work a second time.
"I tapped 'Don't Allow' on notifications"
iPhone: Open Settings → Notifications → Authenticator. Turn on Allow Notifications, plus Sounds and Badges.
Android: Open Settings → Apps → Authenticator → Notifications. Turn on Allow notifications.
Then close the app fully and reopen it.
Android: Open Settings → Apps → Authenticator → Notifications. Turn on Allow notifications.
Then close the app fully and reopen it.
"The sign-in screen is stuck on a spinner / showing an error"
- Make sure your phone is connected to the internet — try opening any website in your phone's browser.
- Force-close the Authenticator app:
- iPhone: Swipe up from the bottom and pause; swipe Authenticator off the top.
- Android: Tap the recent apps button and swipe Authenticator away.
- Reopen the app and start again from Step 3. As long as your TAP hasn't expired, you can pick up where you left off.
"It says I need a password, but I only have a TAP"
- Tap Back and check the email address you typed — even one wrong character will land you on a normal password screen.
- Look for a small link at the bottom of the password screen: "Use your Temporary Access Pass instead" or "Sign-in options" → "Use a Temporary Access Pass".
- If those don't appear, your TAP may have already expired. Contact IT for a new one.
"It tried to autofill a saved password from my phone"
Phones with iCloud Keychain or Google Password Manager may pop up suggesting a saved password. Tap somewhere else to dismiss it, then carefully type your TAP by hand. The TAP is not saved anywhere on your phone.
"I only see 'Scan a QR code' — no 'Sign in' option"
Look carefully at the screen — there's usually a small "Or sign in" link near the bottom, sometimes in lighter grey text. If you genuinely can't find it, update the Authenticator app from the App Store / Play Store and try again.
"Where do I get the number for 'enter the number shown'?"
You won't see this during initial TAP setup — it only appears later, when you actually sign in to a service like Outlook or Teams. When it does, the 2-digit number is shown on whatever device you're trying to sign in on (your laptop, another phone, etc.). Type that number into Authenticator and tap Yes. This is called number matching and stops attackers from tricking you into tapping "Approve" on a sign-in you didn't start.
"I got the wrong app — Google Authenticator / Authy / something else"
Delete that app, and install Microsoft Authenticator (blue padlock with a person silhouette, made by Microsoft Corporation) from the QR codes in Step 1.
"I lost my phone / got a new phone"
You'll need IT to reset your Authenticator setup. Contact the help desk and they'll either issue a new Temporary Access Pass and walk you through this guide again, or restore from cloud backup if you had it enabled.
"It says my phone needs a screen lock"
For security, the app won't work without one. Set it up now:
iPhone: Settings → Face ID & Passcode (or Touch ID & Passcode).
Android: Settings → Security → Screen lock.
Choose at minimum a 6-digit PIN, then return to Authenticator.
iPhone: Settings → Face ID & Passcode (or Touch ID & Passcode).
Android: Settings → Security → Screen lock.
Choose at minimum a 6-digit PIN, then return to Authenticator.
"I don't have a smartphone"
Contact IT — they can set you up with an alternative method like a hardware security key or phone-call verification. Don't try to share another colleague's phone.
"Can I use my personal phone?"
Yes — Microsoft Authenticator does not give your employer access to anything else on your phone. It only stores a small encrypted credential for approving sign-ins. Battery use is negligible.
A Plain-English glossary
- MFA / 2FA (multi-factor authentication)
- Signing in with two things instead of one — usually "something you know" (password) plus "something you have" (your phone). Microsoft Authenticator is the "something you have".
- TAP (Temporary Access Pass)
- A short-lived code from IT that lets you log in once or twice without a password, just long enough to register Authenticator.
- QR code
- The little square pattern of black and white dots. Your phone's camera can read it like a barcode.
- Number matching
- When signing in, the website shows a 2-digit number that you type into the app. Stops attackers from spamming you with fake approval requests hoping you'll accidentally tap "Approve".
- Passwordless
- Signing in by approving a notification on your phone, instead of typing a password. The Authenticator app makes this possible.
Need help?
If you get stuck at any step, contact your IT help desk and tell them which step number you're on (e.g. "I'm stuck on step 6a — the screen lock prompt"). That helps them help you faster than just saying "it's not working".