Long, unique and easier to remember.

• Length is a primary strength factor. Every added character increases the number of possible guesses.
• People can remember words more reliably than short strings such as Tr0ub4dor!.
• Complexity rules often produce predictable patterns—a capital at the beginning, a number at the end and a common symbol.
• Better memorability reduces unsafe workarounds such as reusing passwords or keeping them in an exposed note.

Important: A long passphrase cannot protect you from phishing if you type it into a fake sign-in page. MFA and careful sign-in habits are still essential.

1. Choose four to six unrelated words. A password manager can generate them randomly.
2. Aim for at least 16 characters; longer is better when the service permits it.
3. Add capitalization, spaces, punctuation or numbers only when required or when they help you remember it.
4. Make the passphrase unique to this one account.
5. Test whether it is easy for you to remember but difficult for another person to predict.

Structure example only—do not use it: Lantern-River-Cactus-Window-27. The words are unrelated, the phrase is long and the number is not a birthday or address.

• Your name, company, username, pet, family member, birthday, address or phone number.
• A sentence, quote, lyric, sports team slogan or familiar phrase found online.
• Keyboard walks such as qwerty, predictable substitutions such as @ for a, or repeated words.
• The current year, season or company name appended to an old password.
• Any password or passphrase already used on another website.

Never use the example passphrases shown in a guide or training presentation. Attackers add published examples to their password lists.

1. Is it 16 characters or longer?
2. Does it contain four or more unrelated words?
3. Is it free of personal and company information?
4. Has it never been used for another account?
5. Could someone who knows you guess the pattern?

If any answer raises concern, generate a new phrase rather than making a weak one slightly more complicated.

1. On a computer, open Security info and sign in with your work account.
2. Select Add sign-in method → Microsoft Authenticator.
3. On your phone, open Authenticator and select + → Work or school account → Scan QR code.
4. Scan the code on the computer and approve the test notification.
5. Add another recovery method if your organization permits it.

1. Approve a request only when you just started the sign-in.
2. Verify the application and displayed number or location when shown.
3. Enter the number from the sign-in screen into Authenticator—never a number supplied by a caller.
4. If the request is unexpected, select Deny or No, it’s not me.

MFA fatigue attack: Repeated unexpected prompts may mean someone already knows your password. Deny them, change the password from a trusted device and contact TnT immediately.

• Never give a verification code to a caller, even if they claim to be Microsoft or TnT.
• Never approve a request to “cancel,” “verify” or “secure” an account unless you initiated the sign-in.
• Treat an MFA setup QR code like a password; do not photograph, email or store it.
• Do not use another person’s phone to register your work account.

Passkeys, Windows Hello for Business and FIDO2 security keys verify both the user and the legitimate service, making them more resistant to phishing than passwords and SMS codes.

Use these methods only when your organization and TnT have enabled and approved them. Continue to protect recovery methods because they can become an alternate route into the account.