Service setup
Adding an authenticator to AWS: root and IAM accounts
Find the MFA settings for the right identity, add a virtual authenticator and complete the requested code checks.
Identify whether you use root, an IAM user or organizational sign-in, then open that identity's MFA settings. For virtual authenticator enrollment, scan the QR and submit the codes requested by AWS.
In this article
Identify root, IAM, or federated sign-in
Root and IAM identities have different roles and management routes. Confirm the identity, your permission to manage its MFA and whether the organization uses federated sign-in.
Do not share root credentials or broaden everyday permissions to troubleshoot a code. An authorized administrator should handle restricted enrollment instead of copying another person's secret.
Choose an MFA method in security settings
AWS recommends passkeys or security keys where practical. For a virtual authenticator, check the required TOTP behavior rather than treating any phone notification as a compatible factor.
Also consider device replacement and backup access. A working number on one phone does not establish a recovery process for loss, damage or personnel changes.
Scan the QR code and submit consecutive codes
For the documented IAM-user console flow, assign an authenticator through security credentials, add its setup material and complete confirmation. Do not copy that exact route onto root or federated identities.
That AWS flow asks for two successive codes. Do not enter the same code twice; wait for the next interval, submit promptly and inspect the enrollment result.
Record the device and recovery arrangements
Note the AWS identity, enrolled device, and recovery contact. Root and IAM users have different recovery paths; save the relevant official links and have an authorized administrator arrange team access.
Where your organization allows ordinary TOTP, manage codes with Authenticator Cloud. With Pro, sign into the same account in the app and extension and complete a sync for convenient access when signing into the AWS console.
References
See the official guides above for detailed setup instructions.
Give each account a clear label in Authenticator Cloud so you can find its code when signing into the console.
