This page shows you how to add a second sign-in step and a passkey to your Microsoft 365 work account or your Google account. The single most important action: turn on two-step sign-in today, and never approve a sign-in you didn't start.
| Your account | What applies to you |
|---|---|
| Microsoft 365 work account we manage | Follow the Microsoft steps below. We are your admin, so we may already require two-step sign-in and choose which methods you can use. |
| Google Workspace work account | Follow the Google steps below. Your admin may require two-step sign-in and limit the methods. |
| Personal Google account | Follow the Google steps below. You manage it yourself, so save your backup codes. |
This page is about your Microsoft and Google accounts. For your Rainier IT sign-in (Client Portal, this help center), see Password management.
Two-step sign-in means you prove it's you in two ways: your password, and something you have, usually your phone. Microsoft calls it multifactor authentication (MFA). Google calls it 2-Step Verification. If someone steals your password, they still can't sign in without the second step.
A passkey replaces the password. It lives on your phone, your computer or a small USB security key, and you unlock it with your fingerprint, face or PIN. A passkey only works on the real website it was made for, so a fake sign-in page can't trick you into handing it over.
| Method | How strong | Why |
|---|---|---|
| Passkey or security key | Strongest | Resistant to phishing. A fake site can't use it. |
| Authenticator app with number matching | Good | You type the number shown on your screen into the app, so random prompts can't be approved by accident. A fake site can still steal a code. |
| Authenticator app, approve or deny only | Fair | Attackers can send prompt after prompt until someone taps Approve. |
| Text message or phone call code | Weakest | Codes can be stolen through fake sites or by someone taking over your phone number. Use only if nothing else is offered. |
Any second step is far better than none. If you can, set up a passkey and keep an authenticator app as a backup.
Why this order? The US Cybersecurity and Infrastructure Security Agency (CISA) calls phishing-resistant sign-in, which is what passkeys and security keys use, the "gold standard". It ranks text message codes last and says to use them only as a last resort.
You set everything up on Microsoft's Security info page. It lists the sign-in methods on your account and has an Add sign-in method button.
Microsoft's help pages, with their own screenshots:
If your phone can't read the code, select Can't scan the image on your computer and Enter code manually on your phone.
You'll know it worked when Microsoft Authenticator appears in the list on your Security info page.
When you sign in later, Microsoft shows a number on your screen. Type that number into the Authenticator notification on your phone. Microsoft uses this number matching for every Authenticator notification.
You can only create a passkey if your organization allows it. If you don't see the option, we haven't turned it on for you yet. Ask us.
You'll know it worked when the passkey appears in the list on your Security info page.
If you see a message that your admin has restricted this, or the option you want is missing, that is a setting on our side, not a fault. Call or email us and we'll check it.
These steps work for personal Google accounts. For a Google Workspace work account, your admin may already require 2-Step Verification and may limit which methods you can use. If a step doesn't work, contact your admin.
Google's help pages, with their own screenshots:
Google recommends Google prompts: a notification on your signed-in phone that you tap to confirm it's you. Sometimes Google also asks you to match a number on your computer screen with one on your phone.
Turn on your phone's screen lock first. On an iPhone, iPad or Mac, turn on iCloud Keychain.
To use a USB security key instead, select Create a passkey, then Use another device, and follow the steps on screen.
You'll know it worked when your passkey is listed under Passkeys and security keys in Security & sign-in.
Don't create a passkey on a shared computer, such as a front desk PC. Anyone who can unlock that computer could get into your account.
On a work account, your admin may still ask for your password as well as the passkey.
Backup codes let you sign in if you lose your phone. Each code works once.
Set up at least two methods now, so losing one phone doesn't lock you out.
Attackers who have your password sometimes send sign-in prompt after prompt, hoping you'll tap Approve just to make them stop.
Why tell us? Your second step stopped them, but they still have your password. We change it and check the account for anything else they tried.
| Phone | (206) 593-8072 |
| [email protected] | |
| Client Portal | portal.rainier-it.com |
Last reviewed: October 2026