Retirement of text message and phone call verification for access to campus services
Microsoft is retiring text message (SMS) and phone call verification as multi-factor authentication (MFA) methods. Those on our campus who currently use text messages or phone calls to verify their identity when signing in to university services will need to transition to a different authentication method over the coming months.
CU Boulder is helping students, faculty, staff, retirees, alumni and former students transition to Microsoft Authenticator for MFA instead of using SMS text message and phone call verification. Microsoft is retiring SMS and phone call methods as they are more susceptible to phishing, social engineering and SIM-swapping attacks than modern authentication methods. More applications and services are also beginning to require stronger forms of authentication.
To help ensure a smooth transition, OIT will conduct two phased campaigns targeting users who currently rely on text message and phone call authentication.
What you need to know
If you currently use text messages or phone calls to verify your identity when signing in to university services, OIT encourages you to update your authentication methods now to avoid sign-in interruptions for campus services later.
Step 1: Check if you have an alternative authentication method
Go to the My Sign-Ins page. Before getting to the page, you will be presented with your default MFA method. At that point, click the link that allows you to use a different method. It will say something like I can't use my phone right now, which when clicked, will allow you to try your alternate methods. If that alternate method gets you to your Security info page, then move on to the step below. If that method fails, try another alternative method (if you have one). If you don’t have an alternative method, set up a new one.
Step 2: Make your alternative method your default sign-in method
After confirming your alternate method works or setting one up for the first time, update your account so that it becomes your default verification method instead of SMS or phone calls.
Instructions for viewing and updating your authentication methods are available at:
Find and update Microsoft MFA security info
How this is taking shape
Campaign 1: Faculty, staff and students
The first campaign will focus on active faculty, staff and students. Emails will be sent with your specific deadline.
- Campaign begins: Sept. 21
- Campaign ends: Nov. 20
- Affected users: Active faculty, staff and students who currently use SMS text messages or phone calls as part of their MFA configuration
Users in this group who need to take action will receive direct email communications from OIT explaining:
- Why they are receiving the message
- What action they need to take
- The deadline to complete the change
- Where to find instructions and support resources
Some users may also receive reminders during the sign-in process encouraging them to update their authentication methods.
Campaign 2: Retirees, alumni and former students
The second campaign will focus on users who are less directly tied to the academic calendar. Emails will be sent with your specific deadline.
- Campaign begins: November 2026
- Campaign ends: January 2027
- Affected users: Retirees, alumni and former students who currently use SMS text messages or phone calls as part of their MFA configuration
Like Campaign 1, impacted users will receive direct email communications with instructions and an individual deadline for completing the transition.
Why is OIT recommending Microsoft Authenticator?
While several authentication methods are available, including security keys and passkeys, OIT is recommending Microsoft Authenticator for most faculty, staff and students because it provides a consistent, reliable and easy-to-use authentication experience across the broad range of devices and services used by the campus community.
Other approved authentication methods will continue to be available where appropriate.
What happens if I do nothing?
Users who do not update their authentication methods before their assigned deadline will eventually lose the ability to verify their identity using text messages or phone calls and be blocked from accessing campus services until they update.
Affected users will receive direct communications in advance of any deadline and will be provided with instructions for completing the transition.
Learn more
For step-by-step instructions on viewing and updating your authentication methods, visit:
Find and update Microsoft MFA security info
If you need assistance, contact the IT Service Center:
- Email: oithelp@colorado.edu
- Phone: 303-735-4357.
