Two-Factor Authentication (2FA): Setup Instructions


 

OVERVIEW

Target audience: All McGill faculty, staff, students, retirees, and alumni.

Two-Factor Authentication (2FA) helps protect your McGill account and personal information from online threats by requiring an additional way to verify your identity when you sign in.

Who needs 2FA?

When accessing McGill online services from off campus, you may be prompted to verify your identity using 2FA. Some services may also require 2FA even if you are on campus and connected to the McGill network.

Self-Service Password Reset (SSPR) is closely connected to 2FA. It is a Microsoft feature that allows you to securely reset your McGill password if you forget it or are locked out of your account. SSPR uses your registered 2FA methods to confirm your identity before allowing you to reset your password.

 

In this article:

Before you start

announcement

IMPORTANT: Text message (SMS) and phone call authentication retiring January 28, 2027

 

Starting January 28, 2027 text messages and phone calls will no longer be available as an authentication method when signing in to McGill services or for resetting your password through Self-Service Password Reset (SSPR).

What do you need to do? If you currently use text messages (SMS) or phone calls to verify your identity, you will need to switch to another authentication method before January 28, 2027. Microsoft Authenticator is McGill's recommended and IT-supported option. You can also choose another available method mentioned in this article. 

Before you start:

Set up Microsoft Authenticator app (recommended method) 

tipNOTE:

Microsoft Authenticator app is McGill's recommended and IT-supported authentication method and is prioritized by default. However, you can still choose to set up and use a different authenticator app.


Note the screenshots in these instructions were compiled on an iOS device, your screens may look slightly different.

To set up Microsoft Authenticator:

  1. First, download the Microsoft Authenticator app on your mobile device (iOS or Android).
  2. Now, on your computer, go to https://mysignins.microsoft.com/security-info. If prompted, sign in with your McGill username and password, then complete the 2FA step to verify your identity.
  3. Click Add sign-in method.

     

  4. From the dropdown menu, select Authenticator App. You will be prompted to download Microsoft Authenticator app, since you have already done so in Step 1, click Next.

     

  5. Now, go on your mobile device and open the Microsoft Authenticator app.
  6. In the Microsoft Authenticator app, click on the + (top right) to add an account.
  7. Select Work or school account.


  8. Click Scan QR code.
       

  9. Click OK or Allow on the permissions screens for camera and information access and notifications. 
  10. Now go back on your computer, click Next.

  11. A QR code will appear on your computer screen. Use your mobile device to scan the QR code.
    • If the scan was successful: You will now see your McGill username in the Authenticator app on your mobile device. 
    • If the QR code was not successfully scanned: Click Can't scan image on your computer and follow the prompts.
  12. Your computer will display a success message informing you that you have successfully set up Microsoft Authenticator. 
  13. Microsoft 365 will now send a notification to the Authenticator app on your mobile device. When you see the notification, click Approve or enter the 2-digit code that appears on your computer to complete the verification process.

 

How to set up backup authentication methods for sign-in (2FA) and account recovery (SSPR)

You must set up a back up authentication method in case your primary method is unavailable or not working.

IMPORTANT: 

To set up a backup 2FA method: 

  1. On your computer, go to https://mysignins.microsoft.com/security-info 
    • If prompted, sign in using your McGill username and password, then complete the 2FA steps to verify your identity.
  2. Click Add sign-method
  3. Select one of the following backup methods. For backup purposes, choose a different method from the one you use as your primary method. 
    • Passkey in Microsoft Authenticator: A passkey (PIN, facial recognition, or fingerprint) stored in the Microsoft Authenticator app. See instructions on how to set up a passkey in Microsoft Authenticator.
    • Passkey: A passkey (PIN, facial recognition, or fingerprint) that is stored on one of your devices, including a password manager, or a security key (FIDO2). See instructions on how to set up a passkey.
    • Microsoft Authenticator: Select this option if you want to set up a different authenticator app.
    • Email: Can only be used to verify your identity when resetting your McGill password or recovering your account through SSPR. Email cannot be used for sign-in. If you use this option we strongly recommend that the alternate email (non-McGill) you use is protected by 2FA.



  4. Follow the on-screen instructions to complete the setup. 
  5. Once the setup is complete, you will see a success screen confirming your selections. Click Done. 

 

Verify your 2FA setup

Off-campus:

  1. Sign in to Office 365 with your McGill username and password.
  2. You will be prompted to Approve Sign-in request or to authenticate via your preferred method. 

On-campus:

  1. Using your mobile device, turn off Wi-Fi to disconnect from the McGill Wi-Fi network. (This is necessary as 2FA is not required when connected to the McGill Wi-Fi network. Your setup can only be verified if connecting from another network.)
  2. On your mobile device, sign in to Office 365 using your McGill username and password.
  3. You will be prompted to authenticate via your preferred method.

For further instructions, see how to sign in into your McGill account using 2FA.

Making changes to your 2FA setup

See this article for detailed instructions on how to view and modify 2FA and SSPR account settings.

Troubleshooting

You can refer to the following articles, as they may have the solution:

For immediate assistance, log in to the IT Support site and start a live text chat with an IT Service Desk agent during regular business hours. 

Alternatively, submit a request for 2FA support and assistance. 

Voluntary enrolment in 2FA (retirees and alumni)

McGill retirees and alumni are strongly encouraged to enroll to protect their account. However, if your account is locked for security reasons, you will be required to set up two‑factor authentication (2FA) as an extra protection step. 

To enroll in 2FA (retirees and alumni):

  1. Sign out of all Microsoft 365 online applications.
  2. Enroll in 2FA by completing the form at https://www.mcgill.ca/cybersafe/enroll-2fa.
  3. After a few minutes, your account will be enabled for 2FA. Complete the setup by following the steps outlined above.

Please note: Once you are enrolled into two-factor authentication (2FA), you cannot opt out. However, you can change the method of 2FA you use.

references

ADDITIONAL REFERENCES: