Windows 10: Require MS Authenticator verification after signing into Windows 10 with a MS acct password

Hello,


I have a Windows 10 desktop and I use it with my personal Microsoft account.

I currently log in with 3 methods:

1. My Microsoft account password

2. My Windows Hello PIN Unique for that desktop

3.- My fingerprint


I want to set it up so that:

Option A: Methods 1 and 2 will need a second-step verification from my Microsoft Authenticator App, Method 3 logs in usually, OR

Option B: Methods 1 will need a second-step verification from my Microsoft Authenticator App, Method 2 and 3 log in usually


Are these 2 options possible?

Thanks!

:)

 

MS Acct vs Local acct

Sorry but as far as I am concerned it's exactly the opposite. Local account in Windows cannot be two step authenticated, if someone let's say could physically use my computer when I am not present he could try after trying to get in to a local account and although most probably not having any luck (I use quite strong passwords), I would never even know about that.

With an MS Account I have absolutely no worries. I can give you my MS Account email and password and you would still never get in to my account to check my mail, not to speak about into security settings to change my password or other security options. Always on a new browser, one I have not yet verified, or on a new computer, the two step verification jumps in.

Nobody else can sign in to my MS Accounts.

I thought this about MS Account and how to start using the Two Step Verification might interest others, too, so I spent my insomniac night doing this video:



Brink's excellent tutorial at our sister site the Eight Forums: Microsoft Account Two Step Verification - Turn On or Off

 

MS Acct vs Local acct

I think you can take extra mesurments like two-step authentication, but as you said, using an MS Acct needs you to be more carefull than a local one.

 

MS Acct vs Local acct

But, when used as a login to Windows on a computer (which is all a local account can do) neither can a Microsoft Account!

With the exception that the very first time you login you need to provide a 2-step code, but the problem is it never seems to ask again for a 2-step code.

In the scenario that an attacker has access to my laptop and knows my password, then assuming I've logged in once, the 2-step verification provides no more security, except that the attacker might have access to more things with a Microsoft Account, such as easy access to email.

Sadly the 2-step verification doesn't seem to protect in this scenario.

You'll note who asked the first question on that tutorial. *Wink

Here's the thing - I'm actually quite a fan of 2-step verification, and if it asked me for a 2-step password when I logged into Windows (at least sometimes, or gave me a checkbox to not remember the device) then there would be an advantage over a local account. Hence my question on that tutorial. But as it is, 2-step verification is a bit pointless as far as logging into a computer is concerned, because it remembers the device, seemingly for ever, and an old-fashioned 1-step password is all you need to login.

Incidentally this page says:

... but I just tried logging back in to the test account I set up in Feb 2014 in Windows 8 when I was working through that tutorial. I haven't logged into that account on that computer for ages (certainly more than 2 months) but it still didn't ask me for an authenticator code.

Fair point - you can see who's logged in - although it's unhelpful that the MS Account suggests you logged into Internet Explorer when all you've done is log into a PC - that log could be clearer.

In general, my suspicion is that MS accounts have more ways to go wrong than a local one. I'm still not convinced that I should change my policy of keeping an admin-level local account on each device for maintenance and recovery purposes.