Service overview
Two-Factor Authentication (2FA) and Self-Service Password Reset (SSPR) both help protect your McGill account by verifying your identity when you sign in to McGill services or need to reset your password to recover access to your McGill account.
- Two-factor authentication (2FA) adds a layer of security by confirming your identity in two steps when you sign in to McGill services. It helps protect your McGill account, personal information, and McGill from online threats.
2FA verifies your identity in two steps:
-
- Enter your McGill password
- Complete a second verification step using registered authentication method, such as approving a sign-in notification in Microsoft Authenticator app on your smartphone or using a physical FIDO2 security key.
Even if someone obtains your password, 2FA makes it more difficult for online attackers to gain access to your account without access to your secondary authentication method.
- Self-Service Password Reset (SSPR) is a Microsoft feature that allows you to securely reset your McGill password if you forget it or are locked out of your account. SSPR uses your registered 2FA methods to confirm your identity before allowing you to reset your password.
NOTE: SSPR is only available for McGill accounts with 2FA enabled.
IMPORTANT: Text message (SMS) and phone call authentication retiring January 28, 2027
Starting January 28, 2027 text messages (SMS) and phone calls will no longer be available as an authentication method when signing in to McGill services or for resetting your password through Self-Service Password Reset (SSPR).
What do you need to do? If you currently use text messages (SMS) or phone calls to verify your identity, you will need to switch to another authentication method before January 28, 2027. Microsoft Authenticator is McGill's recommended and IT-supported option. You can also choose another available method.
Who can use it
- All McGill faculty, staff, and student accounts require 2FA.
- McGill retirees and alumni are strongly encouraged to enroll in 2FA to protect their account. However, if your account is locked for security reasons, you will be required to set up 2FA as an extra protection step to regain access.
How to request & access the service
To set up 2FA, you will need:
- Your McGill username and McGill password
- A mobile device, such as a smartphone, tablet, computer, or a physical FIDO2 security key
McGill students, faculty, and staff
All McGill staff, faculty, and students are required to protect their accounts with 2FA.
When you sign in using your McGill username and password for the first time, you will be prompted to set up 2FA:
- Follow the 2FA setup instructions.
- Note: Microsoft Authenticator app is McGill's recommended and IT-supported authentication method.
Retirees and alumni
McGill retirees and alumni are strongly encouraged to enroll in 2FA to protect their accounts. However, if you are a McGill retiree or alumnus whose account is locked for security reasons, you are required to set up 2FA as an extra protection step to regain access to your account.
How to enroll in 2FA voluntarily (retirees and alumni)
- Sign out of all Microsoft 365 online applications
- You can go to www.office.com > click on your profile icon on the bottom left > Sign out.
- Enroll in 2FA by completing the enroll in 2FA form.
- Set up 2FA: After a few minutes, your 2FA will be enabled for your account. Follow the instructions to complete your setup using one of the recommended authentication methods (e.g., Microsoft Authenticator app).
Please note: Once you are enrolled into two-factor authentication (2FA), you cannot opt out. However, you can always change the method of 2FA you use.
Cost
There is no cost associated with this service.
Availability
This service is available 24 x 7.
Frequently asked questions
Best practices & policies
For more information on how personal information is stolen and misused, and how you can minimize your risk, see the article Personal information and identity theft.
Training & documentation
To learn more about 2FA (also known as Multi-factor authentication) and how to protect yourself online, visit Canada's Get Cyber Safe website.
Support
If you require assistance with 2FA or to reset your password using Self-Service Password Reset (SSPR), contact the IT Service Desk.