---

General

Which methods work for 2FA and/or for SSPR?

Authentication method	Usage	How it works
Microsoft Authenticator – notification *NOTE: This is McGill-recommended method	2FA and SSPR	The Microsoft Authenticator app can help prevent unauthorized access to your account by sending a notification to your smartphone or tablet. Simply select "Approve" to authenticate, or "Deny" to protect your account if you are not in the process of logging in. The benefit of receiving a notification is that there are no codes to enter. The app is available for Android, iOS, and Windows.
Authenticator app or hardware token - code	2FA and SSPR	Authenticator apps generate a verification code you can enter into the sign-in interface. To use a different authenticator app, add a sign-in method > Select Microsoft Authenticator > click the link to set up a different authenticator app
Passkey in Microsoft Authenticator	2FA	You can use Microsoft Authenticator app for 2FA notifications AND to create and store a passkey. A passkey is a secure sign-in method stored in the Microsoft Authenticator app. Instead of entering a one-time code or approving a notification, you can use Microsoft Authenticator app to verify your identity using your fingerprint, facial recognition, or device PIN.
Passkey	2FA	A passkey is a modern sign-in method that lets you verify your identity using your device's built-in security features, such as, fingerprint, facial recognition or PIN. Unlike a passkey in Microsoft Authenticator, which is stored in Microsoft Authenticator app, a passkey can be stored in other locations, including: Your smartphone or computer built-in features such as Windows Hello Password managers, such as iCloud Keychain, Google Password Manager A physical FIDO2 security key You can also create and store a passkey directly on your Windows or Mac computer without needing a separate mobile device.
Email address	SSPR only	When resetting your password using SSPR, you will have to go through a two-step verification process using the authentication methods you set up when configuring 2FA/SSPR. Microsoft recommends the use of an alternate email account that does not require the use of your McGill Password to access. A verification code will be sent to your alternate email address. Enter the verification code provided in the sign-in interface to continue.
Phone: Text or Call	Retiring January 28, 2027 (2FA and SSPR)	IMPORTANT:  Microsoft is retiring text message (SMS) and phone call 2FA on January 28, 2027. After that date, they will no longer be available for use. To avoid having to change your 2FA methods, please choose from the other options.
Security questions	Retiring soon (SSPR only)	IMPORTANT:  Security questions will no longer be available for use in the coming weeks. We do not recommend setting them up at this time, as many users end up forgetting the answers and attackers can usually easily find the answers online.

 

 

Getting started with 2FA

Why do I need 2FA?

Passwords can be stolen through phishing, malware, data breaches, or password reuse. 2FA helps protect your account by making it harder for someone to sign in even if they have your password. They would also need access to your second verification method, such as your phone or security key.

Attackers will try to trick you into sharing your 2FA code or approving a sign-in request. Learn how to spot and report phishing to keep your account safe.

---

When will I be prompted to authenticate with 2FA?

The frequency of authentication prompts depends on the application you are accessing and the level of security required. Some services may remember your sign-in for a period of time, while others may require more frequent verification. 

Security level	Authentication frequency
Low	Every 30 days
Medium	Weekly
High	Daily
VPN authentication	Per use

This applies to all staff, faculty, and students working at McGill, regardless of whether a user is on or off campus.

---

Can I use email as an 2FA method when signing in to McGill services?

No. Email is only available when resetting your password or recovering your McGill account. It cannot be used as a 2FA method when signing in to McGill services. 

You can use the following supported authentication methods:

• Microsoft Authenticator app (recommended)
• Passkeys (passkey stored on your device)
• Passkeys in Microsoft Authenticator (passkey stored in Microsoft Authenticator app)

---

Why can't I keep using text (SMS) or phone call 2FA at McGill?

SMS and phone call verification are being retired as part of changes to Microsoft's authentication services and will no longer be available as of January 28, 2027.

---

What mobile device operating systems are supported?

2FA is currently supported on iOS, Android, MacOS, Windows and Linux devices. If you are on an operating system that is no longer supported by the vendor, 2FA might not work.

---

What if I don't have access to a smartphone or tablet?

You can verify your identity using one of these options:

• Use your computer: Download OneAuth on your desktop or laptop to verify your identity. 
• Use a passkey: Set up a passkey through your Apple, Google, or personal Microsoft account, or password manager.
• Use a physical security key: Purchase a FIDO2 security key, a small physical device you can use to verify your identity.

 

Resetting your McGill password with Self-Service Password Reset (SSPR)

What is Self-Service Password Reset (SSPR)?

Self-Service Password Reset (SSPR) is a Microsoft feature that lets you recover access to your McGill account by resetting your McGill password if you have forgotten it or are locked out after too many incorrect sign-in attempts. To use SSPR, you must have 2FA enabled and set up at least two supported identity verification methods set up (e.g., Microsoft Authenticator app and alternate email address).

---

How many verification methods do you recommend I set up for Self-Service Password (SSPR)?

You must set up at least two verification methods so you can still access your account if you lose or change a device. We recommend adding a third method on a different device for extra security.

Examples of verification methods you can include:

• Microsoft Authenticator app on your smartphone
• An alternate email address protected by 2FA
• An authenticator app on your computer

You can add, remove, or update your verification methods on your Microsoft security info page. Follow instructions in the View and modify 2FA and SSPR account settings.

---

Which verification methods can I use for Self-Service Password Reset?

You can use the following methods for Self-Service Password Reset (SSPR):

• Microsoft Authenticator app
• Other Authenticator apps
• Alternate email address (not your McGill email)

Important note: Security questions will no longer be supported as a verification method for SSPR. 

 

2FA account settings, issues, and other questions

How do I update my 2FA account settings?

You can add, remove, or update your authentication methods from your Microsoft security info page. 

For detailed instructions on adding and managing authentication methods, see View and Modify 2FA and SSPR account settings.

---

I received a Microsoft Authenticator app notification, and I was not trying to log in.

If you receive an Authenticator app notification when you are not in the process of logging in, it may be coming from a secondary device (e.g., a device that your spouse or child is logging into). If you are unaware of someone authorized to log into a secondary device, select "Deny" to protect your account and report it to the IT Service Desk immediately.

---

What if I lose or replace my device I use for 2FA?

If you have another authentication method registered, you may be able to use it to sign in and update your methods. If not, you will have to contact the IT Service Desk to have your account reset. Once you have access to your account, update your authentication methods as soon as possible.

---

If I am travelling, will 2FA still work? 

Yes. The Microsoft Authenticator app, which is McGill's recommended authentication method, can be used when travelling. The Microsoft Authenticator App allows you to:

• Approve a notification sent to your smartphone when you have internet access
• Use a verification code generated every 30 seconds when you have limited or no internet access
• Continue authenticating even if you change your SIM card while traveling

Before you travel, make sure Microsoft Authenticator is set up as one of your authentication methods so you can sign in while away.

To check or change your default authentication method:

1. Go to https://mysignins.microsoft.com/security-info
2. Check your Default sign-in method
3. If an app based authentication is not selected, click Change.
   
   
   
   
4. Select a method from the drop-down menu.
   • NOTE: If you won't have access to the internet, select App based authentication or hardware token - code. If you will have access to the internet, any option will work.
     
     
     
     
     
5. When signing in to your McGill account, if you are prompted to enter an authentication code, select Sign in another way and choose Approve a request on my Microsoft Authenticator app or Use a verification code from my mobile app. Note: You must first install the authenticator app on your device.

 

---