Manage app passwords for two-step verification

Important: Your administrator might not allow you to use app passwords. If you don't see App passwords as an option, they're not available in your organization.

When using app passwords, it's important to remember:

• App passwords are autogenerated, and should be created and entered once per app.
• There's a limit of 40 passwords per user. If you try to create one after that limit, you'll be prompted to delete an existing password before being allowed to create the new one.

Office 2013 clients (including Outlook) support new authentication protocols and can be used with two-step verification. This support means that after two-step verification is turned on, you'll no longer need app passwords for Office 2013 clients. For more info, see the How modern authentication works for Office 2013 and Office 2016 client apps article.

Create new app passwords

During your initial two-factor verification registration process, you're provided with a single app password. If you require more than one, you'll have to create them yourself. You can create app passwords from multiple areas, depending on how two-factor verification is set up in your organization. For more information about registering to use two-factor verification with your work or school account, see Overview for two-factor verification and your work or school account and its related articles.

Where to create and delete your app passwords

• You can create and delete app passwords, based on how you use two-factor verification:
• Your organization uses two-factor verification and the Additional security verification page. If you're using your work or school account (such as, alain@contoso.com) with two-factor verification in your organization, you can manage your app passwords from the Additional security verification page. For detailed instructions, see "Create and delete app passwords using the Additional security verification page" in this article.
• Your organization uses two-factor verification and the Office 365 portal. If you're using your work or school account (such as, alain@contoso.com), two-factor verification, and Microsoft 365 apps in your organization, you can manage your app passwords from the Office 365 portal page. For detailed instructions, see "Create and delete app passwords using the Office 365 portal" in this article.
• You're using two-factor verification with a personal Microsoft account. If you're using a personal Microsoft account (such as, alain@outlook.com) with two-factor verification, you can manage your app passwords from the Security basics page. For detailed instructions, see "Using app passwords with apps that don't support two-step verification" in this article.

Create and delete app passwords

You can create and delete app passwords from the Additional security verification page for your work or school account.

Sign in to the Additional security verification page, and then select App passwords.

To delete an app password using the App passwords page

1. On the App passwords page, select Delete next to the app password you want to delete.

Create and delete app passwords using the Office 365 portal

If you use two-step verification with your work or school account and your Microsoft 365 apps, you can create and delete your app passwords using the Office 365 portal.

To create app passwords using the Office 365 portal

1. Sign in to your work or school account, go to the My Account page, and select Security info.
2. Select Add method, choose App password from the list, and then select Add.

password shown in list" />

To delete app passwords using the Security info page

1. On the Security info page, select Delete next to the app password you want to delete.

If your app passwords aren't working properly

Make sure you typed your password correctly. If you're sure you entered your password correctly, you can try to sign in again and create a new app password. If neither of those options fix your problem, contact your organization's Help desk so they can delete your existing app passwords, letting you create brand-new ones.

Next steps

• Manage your two-step verification settings
• Try out the Microsoft Authenticator app to verify your sign-ins with app notifications, instead of receiving texts or calls.