Secure an account
One pipeline, several doors. Pick the method that matches what you already hold — token, inbox code, recovery code, password plus a recovery code, or full credentials.
Methods, one pipeline
Open Secure. The method picker is the whole interaction — pick the door that matches what you already hold. They all join the same pipeline after auth.
- MSAuth — you already have a Microsoft token. Fastest, because login is done.
- OTP — you can read a one-time code from the inbox (or a proof Microsoft lists). No password on this path. If the only proof is a phone, enter the last four digits before the SMS is sent.
- Recovery — you hold the Microsoft recovery code. This is the locked-out-of-email door.
- Mail + password + code — email, password, and a recovery code, for an account that already has authenticator 2FA. The same tile can switch to a 2FA key: email, authenticator secret, and the recovery code.
- Zygercode — email, password, and a TOTP seed together. The most complete starting position.
Custom security email is a switch on this page only. It is off by default, it is not saved, and bulk, bots, Links, and the API do not use it. When it is on, you type the address for that one secure and then each code Microsoft sends there. Addresses on our domains are still read for you.
Which one you use is dictated by what you have, not by what you want. The securing walkthrough is the long version of the order.
What the run actually does
Auth
Establish a live Microsoft session. If this fails, nothing else runs.Snapshot
Read 2FA state, devices, aliases, recovery routes — the picture later steps mutate.Minecraft identity
Resolve the Java profile, IGN, entitlement.Harden
Enable authenticator 2FA when asked, sign out other sessions, strip devices and OAuth apps, leave family groups — each of those is a setting, not a surprise.Land
Write the vault row, stats, recovery material, and (if you have a bot) the hit.Bulk
Bulk takes a list (one account per line, method inferred from the shape). It shares a fair global queue so one huge job cannot starve everyone else. Watch progress in the bulk sheet; open the log sheet if a line fails. Semi-secure is a smaller, centred confirm when you want a lighter pass.
Settings on the run
The settings drawer is the contract for a run: domain for the new security mail, whether to enable TOTP, sign out sessions, remove devices, strip OAuth, leave family, optionally rename. Defaults are the hardening set. Change them before you start, not after. Outlook mail (inbox and sent subjects and previews) is on by default. The language toggle is saved, but display-language changes are paused and the run records Disabled. A stored fast-secure preference does nothing.