What is multifactor authentication?
Multifactor authentication (MFA), also known as two-step login, protects your account by verifying your identity using a second method when you log in.
Why is MFA important?
Cybersecurity attacks are growing more sophisticated and widespread. A strong password is your first line of defense, and a second layer of identity verification enhances security. MFA is a standard security practice for universities and other institutions.
Microsoft will remove SMS and voice call authentication method options in February 2027. This is a vendor-driven change, affecting Microsoft 365 users beyond UMass Amherst. If you have SMS authentication configured, you will be prompted to set up another authentication method when that change occurs. More information
Which authentication methods are available at UMass Amherst?
MFA systems at UMass Amherst can be configured to work with several authentication methods, offering flexibility while keeping university accounts and data secure.
You can add several authentication methods to your account. To add, change, or remove authentication methods, visit mysignins.microsoft.com/security-info - or click an option below for detailed instructions.
Many of the authentication methods listed below use the Microsoft Authenticator app. Follow our guide to install and set up the app.
Microsoft Authenticator App Push Notification
Recommended for most people. Respond to a notification from the Microsoft Authenticator app to finish logging in.
- Requires a smartphone with an internet connection.
- Works with Self-Service Password Reset
if second method is not one-time password in Microsoft Authenticator
Passkey Stored in Microsoft Authenticator app
Recommended for most people. Scan a qr code with your smartphone or mobile device to finish logging in.
- Phishing-resistant.
- Requires a smartphone with an internet connection.
Passkey Stored On Computer With Windows Hello for Business
Recommended for people who use a university-managed Windows computer. Use PIN, fingerprint, or facial recognition on your Windows computer to finish logging in.
- Phishing-resistant.
- Does not require a smartphone.
Passkey Stored in FIDO2 Security Key such as YubiKey
Recommended for people who want strong security without using a smartphone. Use a physical key and a PIN to finish logging in.
- Does not require a smartphone.
One-Time Password Apps
Recommended for password manager users. Check the app for a code, and type it in to finish logging in.
- Works with apps including Google Authenticator, Apple Passwords, etc.
- May not require a smartphone, depending upon the app.
- Works with Self-Service Password Reset
if you use an OTP app other than Microsoft Authenticator, or if your second method is not Microsoft Authenticator push notification.
One-Time Password Hardware Token
Recommended for people without a smartphone. Check a physical keychain device for a code, and type it in to finish logging in.
- Does not require a smartphone.
- Works with Self-Service Password Reset
Need help, or have questions?
Contact the IT Service Desk for help with your UMass Amherst account and IT services.