MFA helps protect your account by adding an extra step to verify that you are who you say you are when you log on. In addition to your password, your account will be protected by “something you have,” such as a smart phone, mobile phone or a hardware token. This helps prevents hackers from gaining access to your account even if they know your password.

Hackers will always try to get our passwords, whether through phishing attacks, guessing attacks or by compromising other websites. MFA provides you the peace of mind that, even if your password is compromised, the hackers will not be able to access and use your account to further their attacks.

All members of the McMaster community, including faculty, staff, and students.

No. MFA is a free, optional service being offered by University Technology Services (UTS) that you can use to protect your account.

There are several options to choose as your second factor:

• The Microsoft Authenticator smart phone app is the recommended method because of its ease of use and  enhanced security. The app can be configured to use either a push notification (most convenient) or a verification code (most secure). The Microsoft Authenticator app includes additional benefits that you can leverage to protect your personal account. Click here for more information about the Microsoft Authenticator app.
• A hardware token is a small fob that provides you with a six-digit code that changes every minute and is used as your second factor. Hardware tokens are not yet available but will be soon.
• SMS text messages can be used to send a 6-digit code to your mobile phone, then entering that code at log in as the second factor.
• Phone calls can be placed to your mobile or office phone to provide you a 6-digit code, then entering that code at log in as the second factor.

After you register for MFA, you will be asked to assert your second factor the first time you log on. You will not be asked to assert your second factor again when you log on from that device and in that location for at least 30 days (for employees) or 90 days (for students).

Only a few minutes. It is amazingly easy!

When you register, you will be asked to setup multiple methods that can each be used to assert your second factor, then select one as the primary method. If you forget your primary at home, you can use one of the others that you configured. If that does not solve the problem, please contact the UTS Client Services for further assistance.

You can setup more than one device. We highly recommend that everyone add at least 2 devices.

The Microsoft Authenticator mobile app is the recommended method for most users. It provides both online and offline code options to log in, which is useful if you are at an offline location. The Microsoft Authenticator app takes up very little space on your phone, and you can use the app without an internet connection or cellular data.

Yes, you can change/update or add more verification methods at any time by visiting your security information.

After you register for MFA, you will be asked to assert your second factor the first time you log on. You will not be asked to assert your second factor again when you log on from that device and in that location for at least 30 days (for employees) or 90 days (for students).

Text messages and voice calls are sent only when you request them and would be billed by your carrier like any other text message or inbound voice call. The Microsoft Authenticator app push notification method uses very little cellular data and will use Wi-Fi if available. The Microsoft Authenticator app software token method does not require an internet connection, and as such, does not incur any expense.

The Microsoft Authenticator app software token method does not require an internet connection and does not use cellular data. You can use it even your device is in airplane mode.

The Microsoft Authenticator app software token method does not require an internet connection and does not use cellular data. You can use it even your device is in airplane mode.

When you received a push notification for a log on that you did not initiate, select DENY to prevent unauthorized access to your account. In these cases, your password may be compromised, and we recommend that you change your password immediately.

No, the Microsoft Authenticator app is light weight and not intrusive.  The app requires access to your camera to setup MFA using the software token method (i.e., to read the QR code), and does not access any other data on your phone. The app does not collect any information from your phone to send to McMaster or Microsoft.

Open the Microsoft Authenticator app and click on Settings. Use Logs to control what data is sent to Microsoft.

Not necessarily. Your password can still be compromised, and you will need to change it if that happens. We still recommend all the advice that we have always recommended with regards to secure passwords: use a unique and strong password that does not contain any dictionary words and a variety of character sets and continue to be on the lookout for phishing emails. If your password does not get compromised, you will not need to change it.

Password complexity requirement is different from multifactor authentication. You still need to change your MacID password when required if you suspect your MacID has been compromised.

Yes, other universities and colleges are using MFA to better protect their data and accounts.

Select “work or school account”.

No, after asserting your second factor, your computer will be trusted from that location and device for 30 days (for staff) or 90 days (for students). You will not be prompted to assert your second factor again unless you switch locations or log on from a different device.

No, you enroll only once when you sign up for MFA.

Yes, you can use the MFA app internationally.

No. MFA does not cause any slow down to the performance of your applications.

Yes, log onto Microsoft’s Office portal. Go to Security Info, View Account and click on sign out everywhere.