Warning
Use an administrator account for these steps, and keep a recent backup before making repair or security changes.
What you will achieve
Lock down the Microsoft account that backs Windows sign-in, Store, and OneDrive with proper MFA.
1) Enable MFA on account.microsoft.com
- Go to Security → Advanced security options.
- Turn on Two-step verification.
- Add Microsoft Authenticator as primary method.
2) Add fallback and recovery options
- Add at least one backup method (SMS or secondary authenticator).
- Generate recovery codes and store them offline.
3) Review trusted devices
Remove old sign-ins under Devices and sign out sessions you no longer use.