0

How do I lock-down my Microsoft account such that a password is required to login?

I logged-into my Microsoft Live account for the first time in some years, and I was horrified by the login workflow:

  1. First it asked me for my username. I entered it
  2. Then it sent me an email and asked me to enter the OTP it sent (some short string of numbers). I entered it
  3. Then I was logged-in!

At no point did it ask me for my password!

I went to my security settings. Under Ways to prove who you are it has two rows:

  1. Enter password
  2. Enter code

It wasn't clear if the two methods were a logical AND or OR, but--from my prior experience--it appears to be a logical OR. I couldn't find a way to switch it to a logical AND. And I couldn't find a way to remove the email OTP as an auth method.

How can I secure my Microsoft account such that auth will fail unless the correct password is entered during login?

Note: This question has nothing to do with Microsoft Windows

Improve this question
4
  • This question belongs on Web Applications Stack Exchange not Super User
    – Ramhound
    Jan 13 at 18:20
  • Also log out when you are done to prevent what happened to you.
    – John
    Jan 13 at 18:21
  • Disabling 2 step authentication seems necessary. You probably had already provided a password recently so your device was recognize.
    – Ramhound
    Jan 13 at 18:25
  • You chose those settings at some point in the past, and Microsoft has some pretty high end security algorithms going on in the background. If there is a reason to mistrust your with attempt Microsoft will require more auth proofs. Presenting only two (username and 2fa challenge) indicates MS believes it is very likely you are the one logging in. Go to your account security settings and adjust your settings as you prefer.
    – music2myear
    Jan 16 at 3:00

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .