---
key: microsoft-inbox-mfa-required
title: Finish a Microsoft sign-in that asks for two-step verification
audience: staff
section: communications/email
routes: ["/settings/communications/email-accounts"]
permissions: ["communications.email.provider_connection.manage"]
features: ["communications.email"]
since: 0.0.1
updated: 0.0.1
status: published
summary: What to do when Microsoft wants a second verification step, such as an app code or security key, before Nova can be connected to a mailbox.
keywords: [two-step verification, authenticator app, verification code, security key, AADSTS50076]
related: [connect-a-microsoft-inbox, microsoft-inbox-conditional-access, microsoft-inbox-account-troubleshooting]
---

In the sidebar, open **Settings**, then choose **Email Accounts** under **Communications** (`/settings/communications/email-accounts`). This screen appears after the Microsoft sign-in step of [[connect-a-microsoft-inbox]], when Nova shows **Microsoft needs an extra sign-in check**.

The Microsoft account requires two-step verification for this sign-in: a code from an authenticator app, a text message, a phone call or a security key. Microsoft asked for it but did not get it, so the mailbox was not connected. On Microsoft's own page this often shows a code such as AADSTS50076.

## Before you start

Make sure the mailbox account has a verification method set up at Microsoft. If it does not, the account owner sets one up there first, in the Microsoft account's security settings; Nova cannot do that for them.

## Steps

1. Select **Start mailbox setup again**. The **Connect mailbox** panel opens.
2. Type the mailbox address in **Mailbox to connect** again, choose the same options, and select the button that reads Go to Microsoft and sign in as followed by the address.
3. On Microsoft's sign-in page, enter the mailbox password, then complete every prompt Microsoft shows: approve on the phone, type the code, or touch the security key. Do not close the window while Microsoft waits for the approval.
4. Accept the permissions when Microsoft shows them.

## What you see

Microsoft sends you back to Nova, which shows **Connected**. Select **Open Email Accounts**; the mailbox appears under **Connected inboxes** on the **Inboxes** tab.

## If something looks different

- No prompt appears and the sign-in fails again: the account may not be allowed to use the verification method it has. For a business mailbox, the Microsoft administrator can check which methods the account may use.
- The screen says **Your company's Microsoft security rules blocked this sign-in**: a device or location rule is in the way as well. See [[microsoft-inbox-conditional-access]].
- The screen says **Microsoft would not sign this account in**: the account itself is locked or expired. See [[microsoft-inbox-account-troubleshooting]].