Secure an account
Four ways in, one pipeline. Pick the method that matches what you already hold — token, inbox, recovery code, or full credentials.
Four methods, one pipeline
Open Secure. The method picker is the whole interaction — pick the door that matches what you already hold. They all join the same pipeline after auth.
- MSAuth — you already have a Microsoft token. Fastest, because login is done.
- OTP — you can read a one-time code from the inbox (or a proof Microsoft lists). No password on this path.
- Recovery — you hold the Microsoft recovery code. This is the locked-out-of-email door.
- Zygercode — email, password, and a TOTP seed together. The most complete starting position. This door can be flagged off.
Which one you use is dictated by what you have, not by what you want. The securing walkthrough is the long version of the order.
What the run actually does
Auth
Establish a live Microsoft session. If this fails, nothing else runs.Snapshot
Read 2FA state, devices, aliases, recovery routes — the picture later steps mutate.Minecraft identity
Resolve the Java profile, IGN, entitlement.Harden
Enable authenticator 2FA when asked, sign out other sessions, strip devices and OAuth apps, leave family groups — each of those is a setting, not a surprise.Land
Write the vault row, stats, recovery material, and (if you have a bot) the hit.Bulk
Bulk takes a list (one account per line, method inferred from the shape). It shares a fair global queue so one huge job cannot starve everyone else. Watch progress in the bulk sheet; open the log sheet if a line fails. Semi-secure is a smaller, centred confirm when you want a lighter pass.
Settings on the run
The settings drawer is the contract for a run: domain for the new security mail, whether to enable TOTP, sign out sessions, remove devices, strip OAuth, leave family, optionally rename. Defaults are the hardening set. Change them before you start, not after.