Passwords can be spotted over someone's shoulder, guessed, or phished. Two-factor authentication (2FA) adds a second step to sign-in, so a stolen password alone is no longer enough. Here's how the different 2FA methods work, how to set them up, and how to avoid locking yourself out of your own mailbox.
How two-factor authentication works
When you sign in, the system checks two independent factors:
- something you know — your password;
- something you have — a phone with an authenticator app, or a hardware key.
If your password leaks — say, an employee types it into a fake login page — an attacker still can't get in without the second factor. This matters a lot for business email: a compromised mailbox can be used to send phishing in your company's name, swap bank details on invoices, and reset passwords for other services.
MCMail supports two-factor authentication for mailboxes with two methods: one-time TOTP codes and WebAuthn/FIDO2 hardware keys.
Method 1: authenticator app (TOTP)
TOTP (Time-based One-Time Password, defined in RFC 6238) generates six-digit codes that change every 30 seconds. The app on your phone and the server share a secret and compute each code from that secret and the current time. Your phone doesn't need an internet connection for this.
Any popular authenticator app will do:
- Google Authenticator;
- Microsoft Authenticator;
- 2FAS or Aegis (Android), both open source;
- the built-in code feature in many password managers.
How to set it up
- Sign in to your account management interface and open the two-factor authentication section. If you're not sure where it is, ask your domain administrator or support.
- Choose TOTP. A QR code will appear on screen.
- In your authenticator app, tap Add and scan the QR code. If you can't use the camera, type in the secret key manually.
- Enter the current code from the app to confirm.
- If the system gives you backup codes, save them (more on that below).
TOTP codes depend on accurate time. If your codes keep getting rejected, make sure your phone is set to update date and time automatically.
Method 2: WebAuthn/FIDO2 hardware key
A hardware key is a small USB, NFC, or Bluetooth device, such as a YubiKey or similar. To sign in, you plug in the key and tap it. If your browser and operating system support it, you can use your device's built-in authenticator instead of an external key — Windows Hello, Touch ID, or Face ID.
The biggest advantage of WebAuthn is phishing resistance. The key is tied to the site's address, so it simply won't work on a fake page, even if the employee doesn't notice the trick. A TOTP code, by contrast, can be read out over the phone or typed into a fake site.
How to set it up
- In the two-factor authentication section, choose WebAuthn/FIDO2 (it may be labeled "security key").
- Give the key a clear name, such as "YubiKey – primary."
- When the browser prompts you, insert the key and tap it, or confirm with your fingerprint.
- Register a second key as a backup and store it somewhere separate.
Comparing the methods
| TOTP app | WebAuthn/FIDO2 key | |
|---|---|---|
| Cost | Free | You need to buy a key |
| Phishing protection | Partial: codes can be entered on a fake site | Strong: the key won't work on another domain |
| Convenience | Open the app and type 6 digits | Insert the key and tap |
| Risk of loss | Losing or resetting your phone | Losing the key |
| Best for | All employees | Executives, accounting, administrators |
A sensible approach for most companies: TOTP for everyone, and hardware keys for the people whose mailboxes are targeted most and who handle payments.
Backup codes and lost phones
Backup codes are one-time codes for when your second factor isn't available. Each code works only once.
- Print them or store them in a password manager. Don't keep them in the same mailbox they protect.
- Don't store them on the phone that has your authenticator app.
- Once you use a code, cross it off.
If you lose your phone and don't have backup codes, contact your domain administrator or support at @mycloudsupport. Once access is restored, change your password right away and set up the second factor again.
When switching phones, move your authenticator first — many apps have an export or transfer feature. Don't wipe the old phone until you've confirmed the new one generates working codes.
Mail apps and 2FA
IMAP, SMTP, and Exchange ActiveSync have no way to ask for a second factor, so Outlook, the iPhone Mail app, or Gmail on Android can't show a prompt for a code. If your administrator has turned on two-factor authentication, check with support how to connect a mail app. Setup guides: iPhone and Mac, Android.
Tips for administrators
- Start with mailboxes for executives, accounting, and shared addresses that receive invoices.
- Prepare a short how-to for staff and run the setup together in a team meeting — you'll get fewer questions.
- Define a recovery process: who to contact when a phone is lost and how identity is verified.
- When an employee leaves, change the mailbox password and remove their keys and devices.
2FA is one layer of protection. Strong passwords and a careful eye for suspicious messages matter just as much — see our articles on mailbox security and phishing.