Multi-Factor Authentication (MFA) for Microsoft 365 Services

What is Multi-Factor Authentication?

Multi-Factor Authentication (MFA) helps protect your account by requiring more than one way to verify your identity when you sign in. Authentication methods generally use:

• Something you know, such as your password.
• Something you have, such as your phone or a hardware security key.
• Something you are, such as your fingerprint or other biometric verification.

At St. Cloud State University, you sign in using your StarID and password, and MFA provides an additional layer of protection for your account, university data, and systems.

MFA is used with many university and Minnesota State services, including Microsoft 365 email, D2L Brightspace, Workday, Zoom, and other services.

Action Required: SMS and Phone Call MFA Ending February 1, 2027

SMS/text messages and phone calls will no longer be supported as MFA methods beginning February 1, 2027.

If you currently receive a text message or phone call to verify your sign-in:

1. Set up a supported MFA method before February 1, 2027.
2. Test your new method to make sure it works.
3. Whenever possible, add a second supported method as a backup.
4. After confirming your new method works, remove SMS/text message and phone call methods from your account.

SMS and phone call methods may remain listed after another method is configured, but they will no longer work for MFA after February 1, 2027. Removing them can help prevent confusion.

Choose an MFA Method

Microsoft Authenticator is the recommended MFA option for most users. It is free and provides secure options for approving Microsoft 365 sign-ins.

Whenever possible, configure more than one supported authentication method. A backup method can prevent you from losing access to your account if your phone, security key, or primary authentication method is unavailable.

*Windows Hello is expected to be available for employees by December 2026. If you are interested in being an early adopter, please contact your technician.  

Important: Keep your authentication device or method available whenever you may need to sign in. Having a second supported method configured can help prevent loss of access if your primary method is unavailable.

Set Up MFA for the First Time

Use these steps when setting up MFA for the first time or after HuskyTech has reset your MFA registration:

1. Go to Microsoft 365 sign-in.
2. Sign in using the appropriate StarID account:
   • Students: StarID@go.minnstate.edu
   • Faculty, staff, and emeriti: StarID@minnstate.edu
3. When More information required appears, select Next.
4. Follow the prompts to configure a supported MFA method.
5. When possible, add and test a second authentication method as a backup.

Add, Change, or Remove an MFA Method

Sign in to Microsoft Security Info to review the authentication methods registered to your account.

From Security Info, you can:

• Select + Add sign-in method to configure another supported method.
• Change or remove an existing authentication method.
• Update your preferred/default sign-in method, when available.

If You Currently Use SMS or Phone Calls

Complete these steps before February 1, 2027:

1. Add a supported authentication method.
2. Test the new method to make sure you can successfully sign in with it.
3. Add a second supported authentication method whenever possible.
4. Remove SMS/text message and phone call authentication after confirming your replacement methods work.

Getting a New Phone?

Set up MFA on your new phone before erasing, trading in, or otherwise losing access to your old phone whenever possible.

1. Sign in to Microsoft Security Info.
2. Install Microsoft Authenticator on your new phone.
3. Add/register Microsoft Authenticator on the new phone.
4. Complete the registration process.
5. Test authentication using the new phone.
6. After confirming the new phone works, remove the old phone's Microsoft Authenticator registration from Security Info.

Important: Simply installing Microsoft Authenticator on your new phone does not automatically transfer or replace the MFA registration associated with your old phone.

If you no longer have access to a working authentication method, contact HuskyTech for assistance. If your MFA registration is reset, you will need to register your authentication methods again.

Unable to Access MFA?

If your phone, passkey, or security key is lost, unavailable, or not working:

If you have another registered method

Choose another authentication method during sign-in and use your backup method.

If you do not have another working method

Contact HuskyTech for assistance regaining access. Depending on your situation, HuskyTech may need to reset your MFA registration or assist with an available temporary authentication option.

This is why configuring more than one supported MFA method is strongly recommended.

Traveling?

Before traveling, especially internationally or somewhere with limited internet or cellular connectivity, make sure you will be able to complete MFA while away.

Before You Leave

• Set up at least two supported authentication methods whenever possible.
• Test each method before traveling.
• If you use Microsoft Authenticator, make sure you can open the app and complete any device PIN or biometric verification it requires.
• If you use a passkey, make sure you will have the device or application where the passkey is stored.
• If you use a hardware security key, bring the key and configure a backup authentication method whenever possible.
• If supported by your account configuration, consider having an authenticator verification-code option available in case push notifications are unavailable.

If Internet or Cellular Service Is Limited

Authenticator apps can generate time-based verification codes without cellular service or an internet connection. Push/approval notifications, however, generally require your device to have internet access.

Make sure any method you plan to use is registered and tested before traveling.

If You Do Not Use a Smartphone

Make sure you have another supported authentication method available, such as a passkey on a compatible device or a compatible hardware security key.

Test the method using the device you plan to take with you before traveling.

If You Lose Access While Traveling

First, try another authentication method already registered to your account. If you do not have another working method, contact HuskyTech for assistance.

Hardware Security Keys

A hardware security key is a small physical device that can be used as an authentication method instead of, or as a backup to, a smartphone-based method.

Availability and recommended hardware depend on your account type:

• Students: May purchase a compatible security key or contact HuskyTech about available checkout options.
• Employees: Contact HuskyTech before obtaining a university-provided security key. Employees may be provided up to one key. Lost or damaged university-provided keys may be charged back to the employee's department.
• Emeriti: May use a compatible security key and should contact HuskyTech for current purchasing and compatibility information.

Because supported authentication methods and hardware requirements can change, contact HuskyTech if you are unsure whether a specific security key will work with your account.

Need Help?

HuskyTech can help you choose, set up, test, or troubleshoot an MFA option that works for you.

Contact HuskyTech if:

• You have questions about which MFA method to use.
• You need help setting up Microsoft Authenticator or another supported method.
• You need or are interested in a hardware security key.
• You replaced or lost your authentication device.
• Your registered authentication methods are not working.
• You are unable to sign in.