Microsoft 365 MFA - FAQ

Multi-factor authentication (MFA) is a way to increase account security by requiring multiple forms of verification to prove your identity when signing into an application or service. This is generally something you know, like a password, and something you have, like a personal mobile device. Many institutions and applications use some form of MFA to log in, especially when using a new device.

Microsoft 365 multi-factor authentication increases the protection on most CU Boulder services and applications, including Microsoft applications, email, Teams, MyCUInfo and Buff Portal. For your convenience, your sign-in session on your regular devices will not require you to log in or use MFA often, but it will protect your account if any suspicious login attempts are detected.

One of our campus's largest attack vectors is through collaboration services; especially email accounts using older protocols. MFA adds an additional layer of security, making it harder for attackers to log in as if they were you. Your information is safer because thieves would need to steal both your password and your phone to access services protected by MFA. MFA has been shown to block 99.9 percent of compromised-credential attacks, which in turn will help to safeguard the university's data, finances, and reputation.

Yes, all CU Boulder Affiliates are required to use MFA when accessing services or applications

CU Boulder does not require the use of a personal phone for MFA, however, we highly recommend using the Microsoft Authenticator app on your personal phone. During extensive testing, we have found this to be the most convenient user experience and simplest method to set up for MFA. 

If you cannot use or do not wish to use your personal phone for MFA, visit the Microsoft MFA service page for alternative options.  

If you require assistance setting up a method for MFA, or feel that none of the listed options will work for you, please contact the IT Service Center at 303-735-4357 or oithelp@colorado.edu.

OIT recommends configuring the Microsoft Authenticator app for all users. It is not country restricted and can be used internationally.

Please note: If you are traveling internationally, you will need to be on Wi-Fi to authenticate with the app; an international data plan is not necessary unless you have no access to Wi-Fi.

To give campus users the right balance of security and ease of use, we've enabled a setting that takes into account many factors to determine if a login attempt is suspicious. If you mostly access services using the same devices and patterns, you should rarely if ever be prompted with MFA. However, if you frequently travel internationally, log in to services and email during trips, or use public computers or kiosks, you could be prompted more frequently due to risky-looking activities.

Use OIT's instructions for registering and using the authenticator app. You can download the Authenticator app directly from Microsoft's Authenticator App page.

Please note: There are other Authenticator apps that intentionally look similar to the Microsoft Authenticator and charge money to download. There is no cost to download and use the Microsoft Authenticator app. Going through links in our documentation or via Microsoft's Authenticator App page ensure you are installing the genuine Microsoft Authenticator App.

Yes, you will be required to enable push notifications during app setup.

No, enabling location services is not required to use the Microsoft Authenticator app. If you would like to check that the Microsoft Authenticator app does not have access to location services, follow the instructions below.

Find and update location services on Android:

• Open the Settings application on your device
• Scroll and select the Location option
• Select App permissions
• Scroll until you find the Authenticator app
  • If it is in the Not allowed section the app does not have access to your location
  • If it is in the Allowed all the time or Allowed only while in use sections, the App may be able to access your location. 
• If the app has access to your location and you would like to block that permission; select Authenticator from the list
• Select Don’t allow and the app will no longer have access to your location

Learn more about privacy and location services on Android's website. 

Find and update location services on iPhone:

• Open your Settings
• Scroll down or search for Privacy and Security
• Select Location services for the list of apps that have any level of location sharing enabled or possible 
• Scroll down to the app you'd like to check and select it to change the level of location access. If the app is not listed, no location services are enabled for it. 

Learn more about privacy and location services on Apple's website.

There are several ways to update or change your authentication information:

• Try to log in to your Microsoft 365 account then open your Security Info settings. These steps are outlined in the Microsoft MFA - Find and Update Security Info tutorial. 
• If you can't log in to your account, reset your MFA using the Self Service Site. Follow our Reset MFA tutorial for help and screenshots of this process.
• Visit Microsoft's additional security verification or change two-step verification and settings help pages for additional information.

If you're unable to log in or change your authentication information, please contact the IT Service Center at 303-735-4357 or oithelp@colorado.edu for assistance.

Alternatives to using Microsoft Authenticator include:

• Yubikey device for mac or windows (Employees should talk with their department about purchasing a Yubikey to use)
• Windows Hello for Business (For Windows 11 Secure Computing systems)
• macOS Passkey (For your Mac Secure Computing System)
• iOS Passkey (Use the Passwords App that comes with your iPhone)
• Android Passkey (Use Google Password Manager or Samsung Wallet, both of which come with your Android Phone)