If I set up 2FA on my Microsoft account (for example) and I create multiple methods such as SMS, email, and an authenticator app, will I be more vulnerable than if I only set up the authenticator app?

I was wondering this because if my email gets hacked then the hacker could just use my email (if they already have my password) to authenticate my identity. If my ex-girlfriend took my SIM card (with my phone number) and knew my password then she could gain access to my account using SMS authentication. So am I correct for assuming that setting up only one method of authentication would make me more secure because it leaves less vulnerabilities to exploit?

I believe that an authenticator app (like Google Authenticator) is the most secure and easy method for the average user but I'd like to know if it's better to go through all my accounts to remove email and SMS as a method.

1 Answer 1


I believe what you're describing is attack surface reduction and the logic checks out; it's easier to defend against a single attack vector than multiple, so having just one 2FA makes you less vulnerable to attack.

But it does mean you have to guard that single 2FA method more closely; not just against attackers, but against yourself & bad luck. If you lose it, you have no secondary way to login. (Think changing/resetting phones, stolen/broken phone, or unlucky software/os update breaks authenticator app). So keep your recovery codes/methods safe & secure or risk lock out.

  • 3
    In essence, having multiple authenticator apps increases your risk of one of them getting compromised, but decreases your risk of losing access.
    – user163495
    Commented Sep 3, 2021 at 14:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .