How to Set Up Two-Factor Authentication for Work Accounts

For Nigerians working remotely, the choice matters more than the generic guides suggest. SMS codes depend on a SIM that can be swapped or lose signal, and a lost phone can lock you out of Slack the morning of a client call. Your IT team may also be six hours away in New York.

This guide covers which 2FA method to choose, how to set it up in Microsoft 365, Google Workspace, Slack and GitHub, how to avoid lockouts when you change phones, and the Nigeria-specific situations worth planning for.

Quick answer

To set up two-factor authentication for a work account, sign in, go to the account's security settings (for example, Microsoft's Security info page or Google's Security and sign-in page) and add a second method. Choose an authenticator app, passkey or security key rather than SMS. Scan the QR code, enter the six-digit code, then save your backup or recovery codes offline. Add a second method so a lost phone doesn't lock you out.

What two-factor authentication is and why employers require it

Two-factor authentication means signing in with two different kinds of proof: something you know (your password) and something you have or are (your phone, a security key, your fingerprint). Multi-factor authentication (MFA) is the wider term for two or more factors. Most work tools use the two terms interchangeably.

The US Cybersecurity and Infrastructure Security Agency (CISA) explains the logic simply. If an attacker gets one factor, such as your password from a phishing page, they still can't meet the second requirement. CISA's MFA guidance says users who turn on MFA are "significantly less likely to get hacked" and that "any MFA is better than no MFA".

Employers care because a remote worker's account is the front door to company email, customer data and code. Many tools now require 2FA:

• GitHub has required users who contribute code on GitHub.com to enable at least one form of 2FA since March 2023, according to GitHub's 2FA documentation.
• On paid Slack plans, workspace owners and admins must use 2FA, and owners can make it mandatory for every member, per Slack's help centre.
• Microsoft 365 and Google Workspace admins usually enforce it through company policy. You'll see a "more information required" screen the first time you sign in.

If your onboarding email mentions "MFA", "2SV" or "2-Step Verification", it means the same thing.

Which second factor to choose for work accounts

Not all second factors are equally strong. Here's how the common options compare for someone working from Nigeria.

Why passkeys and security keys are the strongest

Passkeys and security keys use a standard called FIDO/WebAuthn. CISA describes this as "the only widely available phishing-resistant authentication". If someone tricks you into visiting a fake Microsoft login page, the key or passkey refuses to work on the wrong website. A six-digit code can't do that, because you can type it into a fake page without knowing it's fake. The US standards body NIST makes the same point in its digital identity guidelines (SP 800-63B): codes you type in manually are not phishing-resistant.

Google's 2-Step Verification help page notes that signing in with a passkey skips the separate second step. You get stronger security with less typing.

Why an authenticator app is the practical default

An authenticator app (Microsoft Authenticator, Google Authenticator, Duo Mobile, or a password manager that stores codes) is the method almost every work tool accepts. Google points out that authenticator apps generate codes without internet or mobile service. That helps when your data bundle runs out mid-month or your network is down in your area.

GitHub calls a TOTP app (TOTP stands for time-based one-time password, the rotating six-digit code) its recommended option.

Why SMS codes are a weak choice in Nigeria

SMS is the method most people pick because it's familiar from bank OTPs. For work accounts, avoid it where you can:

• SIM swap fraud. If a fraudster convinces a network to move your number to their SIM, your codes go to them. Nigeria's telecoms regulator, the NCC, has named illegal SIM swaps among the most serious cyber threats in the telecoms sector (ICIR report, December 2019).
• Delivery problems. International SMS from a US or European service to a Nigerian number can arrive late or not at all, and codes usually expire within minutes.
• Roaming. If you travel, your Nigerian SIM may not receive texts abroad unless roaming is active.
• Official warnings. Google describes text and voice codes as the option most vulnerable to phone-number-based attacks. NIST lists SMS/phone network verification as "restricted".

Some employers block SMS completely. Slack lets owners stop members using SMS, and GitHub organisations can lock out members whose only 2FA is SMS. Choosing an app from the start saves you a second setup later.

Before you start: a 10-minute preparation checklist

Do this before the 2FA prompt appears, ideally on a day with stable power and data.

1. Charge your phone and laptop, and make sure the inverter or generator is on. A setup interrupted halfway can leave the account in an awkward state.
2. Install your authenticator app from the official App Store or Google Play listing. Check the publisher name (Microsoft Corporation for Microsoft Authenticator, Google LLC for Google Authenticator) to avoid lookalike apps.
3. Set a screen lock on your phone (PIN, fingerprint or face). Anyone who can open your phone can approve your work sign-ins.
4. Check what your employer requires. Read the IT onboarding email or internal wiki. Some companies mandate Microsoft Authenticator, Okta Verify or Duo, and some issue security keys.
5. Prepare a safe place for backup codes. That could be a password manager, a printed sheet kept somewhere secure at home, or both. Not a screenshot in your gallery, which syncs to the cloud and sits on the same phone you might lose.
6. Note your IT team's contact and working hours. If they're in New York, they're 5 hours behind Lagos in summer and 6 in winter (from 1 November 2026). A lockout at 9am in Lagos may mean waiting until mid-afternoon for help.

How to set up 2FA on the work tools you'll use most

Menu names change and your company's settings can override them, so treat these steps as a guide and follow your employer's instructions where they differ. Steps were checked against each vendor's help pages as of October 2026.

Microsoft 365 (Outlook, Teams, OneDrive)

Microsoft's Authenticator setup guide for work or school accounts describes this flow:

1. On your laptop, go to mysignins.microsoft.com/security-info and sign in with your work email.
2. Select Add sign-in method, choose Microsoft Authenticator and select Add.
3. Select Next to show a QR code.
4. On your phone, open Microsoft Authenticator, tap the plus icon, choose Work or school account, then Scan a QR code.
5. Approve the test notification that appears on your phone.

If your camera won't scan, choose "Can't scan the image" on the laptop and enter the code manually in the app. If you see a message about a restricted location or a blocked registration, a company policy is stopping you, and only your admin can fix it.

While you're on the Security info page, add a second method (another authenticator, a security key, or a phone number as a last resort) so you're not relying on one phone.

Google Workspace (Gmail, Drive, Meet)

According to Google's help page:

1. Open your Google Account and go to Security and sign-in.
2. Under "How you sign in to Google", select Turn on 2-Step Verification and follow the steps.
3. Add a passkey if your device supports it, or Google prompts, or an authenticator app.
4. Generate backup codes (a set of 8-digit one-time codes) and store them offline.

Google notes that on work or school accounts these steps may not work as described because your administrator controls the settings. If the option is greyed out or missing, contact your admin. When Google offers "Don't ask again on this device", tick it only on your own laptop, never on a shared or public computer.

Slack

Slack sets up 2FA separately for each workspace, so if you're in several client workspaces, repeat it in each. From Slack's instructions:

1. Go to your Account settings page and expand Two-factor authentication.
2. Enter your password and choose Use an app (preferred) or SMS.
3. Scan the QR code with your authenticator app, enter the six-digit code and select Verify code.
4. Save the backup codes Slack shows you. Each works only once.

Slack doesn't accept hardware security keys for its own 2FA (as of October 2026). If you're locked out, a workspace owner or admin can switch off 2FA on your account so you can set it up again.

GitHub

From GitHub's 2FA documentation:

1. Click your profile picture, then Settings, then Password and authentication.
2. Click Enable two-factor authentication.
3. Scan the QR code with your authenticator app and enter the code.
4. Download your recovery codes and confirm you've saved them.
5. Add a passkey, security key or GitHub Mobile as an extra method.

GitHub does support SMS to Nigerian numbers: Nigeria appears on its list of countries where SMS authentication is supported. GitHub still treats SMS as the less preferred option, and some organisations refuse members who rely on it.

Freelance, contractor and payment platforms

If you're paid as a contractor, your income runs through accounts such as Upwork, Deel, Remote.com, Payoneer or Wise. These need 2FA at least as much as your work email does. The menu is usually under Settings, then Security or Password and Security. Pick an authenticator app where it's offered and save the recovery options. Our guide to receiving dollar payments in Nigeria covers the apps themselves.

Backup codes and recovery: how not to lock yourself out

Most 2FA problems aren't hacks. They're lockouts: a phone dropped in a danfo, stolen at a junction, or reset to factory settings. Plan for that before it happens.

Keep at least two ways to sign in

Register two methods on every important work account. A good pair is an authenticator app plus a passkey on your laptop, or an app plus a security key. GitHub suggests adding another method precisely to reduce the risk of lockout.

Store backup codes properly

Backup or recovery codes are your emergency exit. Store them in two places that won't fail together:

• In your password manager (see our planned guide to password managers for remote workers)
• On paper, in an envelope at home, labelled only with the service name

Never send backup codes over WhatsApp, email them to yourself in plain text, or share them with anyone, including someone who says they're from IT.

Changing phones

This is where many people get caught. Microsoft's Authenticator backup and recovery page says credentials for work or school accounts are not backed up. Only the account name moves across, and you have to sign in and register the account again on the new phone. Backups also can't move from iPhone to Android or the other way round.

The safe order:

1. Set up the new phone while the old one still works.
2. On each work account's security page, add the new phone as a method and test it.
3. Only then remove the old phone and wipe it.

If you sell or trade in your old phone in Computer Village or online, do it after step 3, not before.

If your phone is lost or stolen

1. Sign in with a backup code or your second method and remove the lost phone from every account's security settings.
2. Tell your employer's IT team the same day. They can revoke sessions on the lost device.
3. If you used SMS anywhere, go to your network's customer service centre with your ID to block and replace the SIM. Do it quickly, because a missing SIM is exactly what a SIM swap fraudster wants.
4. Change the passwords for accounts that were signed in on the phone.

Nigeria-specific situations to plan for

Power cuts and data outages

Authenticator app codes are generated on the phone itself, so they keep working with no data and no network signal. Only the clock needs to be right (set your phone to automatic time). Push prompts and SMS both need connectivity. If your area loses network during a storm or a fibre cut, an app code will still let you in through your laptop's backup connection.

Two phones, two SIMs

Many Nigerians carry two lines. If your employer insists on a phone number as a backup method, use the line you guard most carefully and never give out publicly. Keep the authenticator app on the phone that stays with you every working day.

Travelling with a work account

Before travelling, outside Nigeria or just to another state for a wedding, check that you can sign in without SMS. Some employers' security systems flag sign-ins from new countries. If you're going abroad, tell IT in advance, and keep backup codes with you (not in the same bag as the phone). If you're considering working from abroad for longer, our digital nomad visa guides cover the immigration side.

Shared laptops and cybercafés

Don't sign in to work accounts on a shared family laptop or a business centre computer. If you must, never tick "Don't ask again" or "Remember this device", and sign out completely afterwards.

Your NIN-linked number is not a security factor

Your phone number is linked to your NIN, and your bank uses your BVN-linked number for OTPs. That makes your number important, but it doesn't make it secure. Keeping work 2FA off SMS means a SIM problem doesn't take your job accounts down with your bank alerts.

Common mistakes and 2FA-related scams

Mistakes that cause lockouts

• Setting up only one method and no backup codes.
• Deleting the authenticator app, or wiping the phone, before moving accounts.
• Screenshotting QR codes or backup codes into the phone's gallery.
• Leaving the phone clock on manual time, which makes app codes fail.
• Setting up 2FA on a personal Slack login and forgetting the client workspace needs its own.

Scams that target your codes

A 2FA code or approval request is the last thing standing between a fraudster and your account, so scammers will try to get you to hand it over.

• "Read me the code we just sent." No genuine recruiter, employer or platform support agent needs your 2FA code. Anyone asking for it is trying to sign in as you.
• Prompt bombing. If your phone suddenly shows approval requests you didn't trigger, someone has your password. Deny them, change the password and tell IT. CISA recommends number matching (where you type the number shown on the login screen into your phone) precisely to block this kind of push bombardment.
• Fake login pages. A link in a "new job offer" or "payroll update" email that leads to a lookalike Microsoft or Google page can capture both your password and your code. Passkeys and security keys defend against this. Our planned guide on avoiding phishing while working remotely goes further.

For the wider warning signs of fake jobs, see how to spot remote job scams in Nigeria.

Frequently asked questions

Is two-factor authentication the same as multi-factor authentication?

Mostly, yes. 2FA uses exactly two factors, while multi-factor authentication (MFA) means two or more. Work tools use the terms loosely, and Google calls its version "2-Step Verification".

Which is the best 2FA method for a remote worker in Nigeria?

A passkey or hardware security key is strongest because it resists phishing. Where those aren't offered, an authenticator app is the best everyday choice because it works without data or signal. Use SMS only if nothing else is allowed.

Can I use one authenticator app for all my work accounts?

Yes. One app such as Microsoft Authenticator or Google Authenticator can hold codes for Microsoft 365, Slack, GitHub and most other services. Your employer may require a specific app for its own accounts, so check the onboarding instructions.

Do authenticator apps need internet to work?

No. Authenticator app codes are calculated on the phone from a shared secret and the current time, so they work offline. Push approvals do need data, and your phone's clock must be set automatically for codes to match.

What happens if I lose my phone and I have no backup codes?

You'll need your employer's IT team or the platform's support to reset your 2FA, which can take hours or days. For Slack, a workspace owner or admin can switch off 2FA on your account. Set up a second method now so this never becomes your only route.

Will my work account move automatically to a new phone?

Usually not. Microsoft states that Authenticator does not back up credentials for work or school accounts, so you have to register again on the new phone. Add the new phone before you wipe the old one.

Is it safe to use my Nigerian phone number for SMS codes?

It works, but it's the weakest option. SMS codes can be intercepted through SIM swap fraud, and international texts to Nigerian numbers can be delayed. Use an authenticator app or passkey for work, and keep SMS only as a last-resort backup if your employer requires a phone number.

Should I turn on 2FA for my personal accounts too?

Yes, especially your personal email, LinkedIn and any payment apps. Your personal email is often the recovery address for everything else, so if it's taken over, your work accounts can follow.

Key takeaways

• Two-factor authentication adds a second proof of identity, so a stolen password alone can't open your work accounts.
• Choose passkeys or security keys first, an authenticator app second, and SMS only as a last resort.
• Microsoft 365, Google Workspace, Slack and GitHub each have their own setup page, and your employer's policy can override what you see.
• Always register two methods and store backup codes offline in two places.
• Microsoft Authenticator doesn't back up work accounts, so add your new phone before wiping the old one.
• No genuine employer, recruiter or support agent will ever ask you for a 2FA code.

Next steps

Set aside 30 minutes this week to switch on 2FA for your work email, Slack and any freelance or payment platform you use, and save your backup codes as you go. Then read our planned guides to keeping your home office network secure and cybersecurity tips for working from home. If you're still looking for your next role, browse remote jobs open to applicants in Nigeria and save a search to get free daily email alerts for new matching listings. If security interests you as a career, our IT support specialist career guide explains how people get into that work remotely.

Sources

• Multifactor Authentication, CISA
• Turn on 2-Step Verification, Google Account Help
• Set up the Microsoft Authenticator app as your verification method, Microsoft Support
• Back up and recover account credentials in the Authenticator app, Microsoft Support
• Set up two-factor authentication, Slack Help Center
• Configuring two-factor authentication, GitHub Docs
• Countries where SMS authentication is supported, GitHub Docs
• NIST SP 800-63B Digital Identity Guidelines: Authentication and Authenticator Management (Rev. 4), NIST
• Illegal SIM swaps, USSD top most serious cyber threats in telecom sector: NCC, ICIR (12 December 2019)