MFA adds additional protections to your account, helping to protect your email, files in your OneDrive storage, and messages and content in Microsoft Teams. After enabling MFA for all accounts, organizations and their users report a dramatic reduction in email spam, phishing, and scam messages.

The Microsoft Authenticator app is recommended and supported by ITS, but you can register and use other authenticator apps if you wish (e.g. Google Authenticator, Authy, etc.). Support for alternative authenticator apps is limited to a best effort, and we cannot guarantee all authenticator apps will work.

Please visit the App store for your device for the most up to date information.  .

Currently, the App is supported by Microsoft on:

• Android 8 and above
• iPhone/iPadOS 14.0 and above

Please contact the ITS Service Desk to discuss the available options.

Sharing your My杏吧原创One (MC1) account with someone else goes against 杏吧原创 University policies that are intended to safeguard your data and privacy. In many cases, access to services or data can be delegated to other accounts. Please contact the ITS Service Desk to discuss options for delegation.

Please contact ITS Service Desk for assistance.

You will need internet access to install and register the Microsoft Authenticator app. Having internet access while using the app is preferred, as it provides the capability for the push notifications on your device, but it is not required. If you do not have internet access on your device, you can use the app to generate a 6-digit One-Time-Password that you can enter as your second factor for authentication.

You can choose to use another authenticator app if you wish (e.g. Google Authenticator, Authy, etc.). Support for alternative authenticator apps is limited to a best effort, and we cannot guarantee all authenticator apps will work.

MFA is not currently required for Brightspace, but it may be required at some point in the future.
**Note – If you are also an employee you will be required to MFA to access BrightSpace using your staff @cunet.carleton account, setup found here.

You will have fourteen days as part of the Soft Enrollment phase. Once fourteen days has passed and the Soft Enrollment phase has ended, you will be required to complete the MFA setup before accessing 杏吧原创 services.

You can tap on Cancel, which will return you to the What kind of account are you adding menu (Step 4 on Phase 2 of our documentation page) where you can select Scan QR Code.

All mobile phones now include the ability to automatically delete seldom-used apps. If the Microsoft Authenticator is offloaded by your phone’s automatic offloading feature, you may encounter difficulties when trying to authenticate. To keep the Authenticator app active and avoid interruptions, ensure that the Automatic App Offloads feature is disabled on your mobile device.

Steps for iOS Users:

1. Open the Settings app on your iPhone or iPad.
2. Scroll down and tap on Apps, then App Store.
3. Under the Offload Unused Apps section, toggle the switch to off.

Steps for Android Users:

1. Open the Google Play Store app.
2. Tap the three lines in the top left corner of the screen.
3. Tap “Settings.”
4. Tap “Auto-manage apps.”
5. Toggle on the switch next to “Archive unused apps.”

NOTE: Steps may vary by device and operating system version. .

 Soft Enrolment

Students will automatically begin seeing prompts to set up MFA when they attempt to log into 杏吧原创 services using their My杏吧原创One password. The prompts should match the screenshot below.

During this phase, students will be given the choice of the following:

1. Click Next and follow the prompts to exit the Self Enrolment Phase and enrol in MFA.
2. Click Skip for now (14 days until this is required) to continue on in the Self Enrolment Phase and access to the service they were attempting to log into. Please note that this option will disappear 14 days after it is first clicked. This means the Self Enrolment Phase has ended, at which point students will be required to click Next and set up MFA before accessing 杏吧原创 services. Details about how to set up MFA are covered in the remainder of this page.

Note: If the Self Enrolment Phase has ended and a student urgently needs to log into a 杏吧原创 service, they can request an exception by contacting the ITS Service Desk. In this scenario, the student in question would be required to set up MFA at a later time.

 MFA Enforcement

Students who have exhausted the 14-day grace period will encounter a prompt that should match the screenshot below. This prompt signals that the grace period is now over and students will be prevented from logging into 杏吧原创 services until they have set up MFA.

To download and configure the Microsoft Authenticator, follow these steps:

1. Click Next to proceed to the screen below
   **Note: If you already have the Microsoft Authenticator app installed you can proceed to step 2

2. Click . You will be taken to a Microsoft page that directs you to the Microsoft Authenticator app within the Apple App Store or Google Play Store, depending on your device’s operating system. Download the app on your phone to proceed.
3. Once you have downloaded the app, return to your browser window and click Next to proceed to the screen below.

4. If prompted, allow notifications within the Microsoft Authenticator app, then click + to add an account.

4. Select Work or school.

5. Select Scan QR code and a QR code scanner will activate on your phone

6. On the screen below in your browser, click Next to reveal the QR code. Scan it using the app on your phone, not just your camera.

7. Once you have scanned the QR code, your Cmail account will appear in the Microsoft Authenticator app on your phone.

8. On the page below in your browser, click Next to proceed.

9. An authentication prompt will provide a number. Type this number into the prompt that appears in the Microsoft Authenticator app on your phone and select Yes.

10. The prompt will be approved. Click Next.
11. This will conclude the steps to set up Microsoft Authenticator and MFA. Click Done.
    

Configure MFA Synced Passkeys as a MFA Option

A Microsoft MFA Passkey is a simple, password‑free way to sign in using something that’s already built into your device — like Face ID, Touch ID, Windows Hello, or your phone’s built‑in unlock method. Instead of typing a password or entering a code, you just use your face, fingerprint, or device PIN to confirm it’s really you.

A Private key is stored in a passkey provider’s cloud and synced across devices that the user is signed into, examples:

• Apple iCloud Keychain
• Google Password Manager

Benefits are if you have replaced your phone, if you sign into the new phone with the same iCloud/Google account that you setup your Passkey with, you would have access to the passkey and your M365 (Cmail/OneDrive) accounts.

Configure a synced Passkey

• The site to manage your sign in options is . Sign in with your Cmail address and password.
• Click the “Add sign-in method” .

• Choose the ‘Passkey‘ option from the window  > Next > Change
• Choose where to save your Passkey
• 
• User experience – Authentication
  • When signing into a M365 resource you can use the Passkey option to authenticate.
    
• 

Managing your MFA Methods

Signing into  is where you manage your MFA sign‑in methods, including setting up the Microsoft Authenticator app and adding backup options to keep your account secure and accessible

• Visit . Sign in with your Cmail address and password.
• Click the “Add sign-in method” button and follow the on-screen instructions.

How to Use MFA Once You Have Enrolled

For information on how to use MFA once you have enrolled, view our documentation page.

Note: Other authenticator services are useable, but not supported.