Multi-Factor Authentication (MFA) - FAQ

Multi-Factor Authentication - Frequently Asked Questions
 
Table of Contents:
General - Frequently Asked Questions
Using - MFA Frequently Asked Questions  
 

General FAQs

What is Multi-factor Authentication (MFA) / Two-factor Authentication?  

Multi-factor authentication (MFA) seeks to decrease the likelihood that others can access your data. Specifically, it enhances the security of your NetID by using your phone, tablet or other device to verify your identity when you attempt to access Brockport's network and resources from an off-campus location. 

It takes two items to access and update your information: “something you know” (like your password) and “something you have” (like your phone). 

For example, when you visit an ATM, one authentication factor is the ATM card you use to start the transaction - that’s the “something you have.” Next, you enter a PIN, which is the “something you know.” Without both factors, your authentication will fail. 

Why Do I Need to Use MFA?  

Brockport accounts are under constant attack from all over the world. Passwords are becoming increasingly easy to compromise. They can be stolen, guessed, and hacked, and new technology and hacking techniques combined with the limited pool of passwords most people use for multiple accounts means information online is increasingly vulnerable. You might not even know who else has your password and is accessing your accounts. 

In addition, experience has shown that people are not as good at recognizing malicious email as you might think. Every day, members of the Brockport community fall prey to these kinds of scams. We have to take steps to ensure that we are more than just a single click away from becoming a victim of identity theft or having your data stolen. 

Multi-Factor Authentication adds a second layer of security to your account to make sure that your account stays safe, even if someone else knows your password. This second factor of authentication is separate and independent from the NetID and password step — MFA never uses or even sees your password. 

Who is eligible to use MFA?  

All faculty, staff, alumni, and student accounts. 

Am I required to use two-factor authentication?  

All Brockport person accounts are required to use two-factor authentication when logging into Office 365 from an off campus location.

Whom should I contact if I have questions or need help setting up MFA?  

If you have any questions or need assistance setting up MFA, please contact the Brockport IT Service Desk at Brockport.edu/go/itservicedesk .

What is the definition of “Off-Campus”?  

Off-campus is anywhere other than:  

  • Brockport Secure Wireless 
  • Brockport Wireless
  • Brockport Guest
  • Brockport hard wired network
  • Brockport Downtown
  • Brockport Residence Halls

Using MFA - FAQs  

How Does Multi-Factor Authentication (MFA) Work?  

Once you have signed up for MFA, when you attempt to access a protected college application from an off-campus location, you will be prompted to enter your username and password as usual (the first “factor”). You will then be taken to the MFA screen where you will select the device of your choice and the preferred method of verification: push notification, a phone call, or a passcode — you will use to verify that it’s you (the second “factor”). 

How will I enroll devices?

When your group is enrolled you will be prompted to register your devices. It is strongly encouraged to have at least two devices registered. Instructions to setup MFA can be found here: https://brockport.teamdynamix.com/TDClient/1842/Portal/KB/ArticleDet?ID=87165 .

What Devices Can I Use?  

MFA lets you link multiple devices to your account, so you can use your mobile phone, a landline, and a hardware token, as your second factor. We strongly suggest setting up multiple devices.

When you are doing your initial setup, you may add as many devices as you like (landline and/or mobile). Subsequently, when you are logging in you can choose which device the authentication request is sent to and which authentication method you would like (via Microsoft Authenticator Mobile App, SMS text message, or phone call). 

I’ve selected to automatically send push notifications to my phone, but I need to authenticate using another device.  

You can sign in with the link to use a different method. From there you can use the other device option you setup when you registered.

How do I add a new device or manage an existing one?   

Instructions on managing devices and enrolling/registering a new phone, tablet, desk phone can be found here: https://docs.microsoft.com/en-us/azure/active-directory/user-help/multi-factor-authentication-end-user-manage-settings

How long does it take to enroll/register a device for MFA?  

 5-10 minutes  

How many devices should I add?  

We recommend that all users add at least 2 devices, such as a cellphone/smartphone and a landline/desk phone.   

Do I need to have a smartphone to use MFA?  

No, you can use a cell phone, landline (such as your office or home phone), tablet, or hardware token, too. We recommend that users who have a smartphone choose to use them, since they are the easiest to use with MFA. 

What if I forget my smartphone at home?  

We encourage users to set up multiple authentication devices with MFA, so that when one method is unavailable, you have others from which to choose. For example, you could set up your smartphone for “push” and also your office phone and home phone to do callback. You can also register a hardware token, too. 

What happens if I lose my phone?   

Contact the IT Service Desk immediately if you lose your phone or suspect that it's been stolen. 

While it's important that you contact the Service-desk if you lose your phone, remember that your password will still protect your account.  

What happens if I get a new device or replace my phone with the same number?   

If you have a new phone with the same number, you can use the alternate MFA device to authenticate and add your new phone.    

If you have a new number, but still have your old phone you can use that to authenticate, remove your old number, and register your new number.

If you do not have access to your old number or device you will need to contact the IT Service Desk.

Does it cost me money to authenticate with my phone?   

”Push” authentication uses a very small amount of Internet data traffic to function (a few kilobytes per login). Text messages and voice calls are sent only when you request them, and would be billed by your carrier like any other text message or inbound voice call. The Microsoft Authenticator app also works like a token and can generate a passcode, this functionality will not require any data and works even when your smart phone is in airplane mode.  

What if I don’t have a data plan on my phone?   

The Microsoft Authenticator app provides options that work without a data plan, a texting plan or even a connection, if necessary. The app can generate the required code without need of either a cell signal or data plan, and it can do so anywhere in the world. If you have a signal and data plan, the app makes two-factor authentication as easy as a pushing a single button, but if you don’t, you can use the app to generate a six digit code and enter that instead. 

What if I don’t have a connection?  

The Microsoft Authenticator app can generate a passcode without a cellular or wireless connection. Alternately, you may use a landline phone if an Internet connection is unavailable.  

What is the user experience if you are using your phone or an iPad on a cellular network or on a non-Brockport wifi network and need to log in?   

You will be prompted to MFA since this is considered an off campus network. If the registered device is the same as the one being used to login, the MFA app will notify & prompt for confirmation and users can confirm access the usual way. Alternatively, a secondary device can also be used to confirm the MFA 

How would one log into an MFA resource or webmail on an airplane equipped with wifi? What would the experience be in this situation using a laptop, iPad, or phone?   

This experience will be the same no matter what off campus location you are trying to log in from.  You will be required to authenticate with MFA.  In the case where a push or text is not working, your phone will function like a token while in airplane mode generating a passcode every 30 seconds. 

Can I use the MFA app internationally?  

The Microsoft Authenticator app is designed to work internationally. If you install the app, it can generate the required code without need of either a telephone signal or data plan, and it can do this anywhere in the world. If you have a signal and data plan, the app makes two-factor authentication as easy as a pushing a single button, but if you don’t have one of those two things, you can use the app to generate a six digit code and enter that manually. 

Can the system handle international phone numbers?   

Yes, MFA can handle international phone numbers.  If entering an international phone number, you can leave a space between country code, city code, and the phone number. 

How long will my authentication last?  

You will be required to MFA every time you log in, when off-campus.  This will last for the lesser of your session or 24 hours.   You will have the option to remember your device for 30 days.  This functionality is browser based so you will have to do it in each browser you use. 

If you need further assistance, please place a ticket here: I Need Help , or call the call the IT Service Desk at  (585) 395-5151 Option 1. 

0% helpful - 4 reviews