How to use multi-factor authentication (MFA)

Microsoft Authenticator

Microsoft Authenticator is an app for Android and Apple mobile devices.

The app prompts for authorisation if an internet connection is available, or can provide a one-time password.

1. Download Microsoft Authenticator from your device's app store
2. In a web browser, sign in to the My Sign-Ins website using your username in the format [email protected], SSO password, and MFA if it is already set up on your account
3. If account setup does not start automatically, select +Add sign-in method
4. Select Microsoft Authenticator > Next
5. If available, select Pair your account to the app by clicking this link (then skip to step 8)
6. Select Next or Show QR code
7. In Microsoft Authenticator, select + > Add account > Work or school Account
8. Select Scan a QR code, then scan the QR code shown on the My Sign-ins website
9. Return to the My Sign-Ins website, then select Next to display a two-digit number
10. Return to Microsoft Authenticator, then provide the test notification with the two-digit number from the My Sign-Ins website

Passkey in Microsoft Authenticator

Microsoft Authenticator can store a passkey for your University account.

A passkey allows you to sign in using your device's PIN, fingerprint or face recognition

1. Download Microsoft Authenticator from your device's app store
2. In a web browser, sign in to the My Sign-Ins website using your username in the format [email protected], SSO password, and MFA if it is already set up on your account
3. If account setup does not start automatically, select +Add sign-in method
4. Select Passkey in Microsoft Authenticator > Next
5. You will need to finish creating your passkey in the Microsoft Authenticator app
6. Open the app
7. If you already have your account linked to the Authenticator app you can select you account and select create a passkey
8. If this is the first time using the Microsoft Authenticator add you will need to select + > Add account > Work or school Account, then sign in and your passkey will be created

Alternative authenticator

Many authenticator apps, can provide a one-time password. They should not require internet access or phone connectivity.

The setup process is provided below, but you may need to refer to your apps documentation.

1. Download and install the authenticator
2. Open the authenticator and start the process to add a new account
3. In a web browser, sign in to the My Sign-Ins website using your username in the format [email protected], SSO password, and MFA if it is already set up on your account
4. If account setup does not start automatically, select +Add sign-in method
5. Select Microsoft Authenticator > I want to use a different authenticator app > Next
6. If a QR code is displayed, either scan it with the authenticator (then skip to step 9) or select Can't scan image
7. In the authenticator, provide the secret key displayed on the MySign-Ins website
8. If asked to select the token length, choose 6 digit
9. Return to the My Sign-Ins website, select Next then provide the 6 digit code displayed in the authenticator

OneAuth

Zoho OneAuth is an alternative authenticator app available for Windows, macOS, iOS, and Android devices.

OneAuth provides a one-time password.

1. Install OneAuth from the Microsoft, Apple or Android app store (titled Authenticator App - OneAuth)
2. Sign in to OneAuth using a Zoho account. You can create a free Zoho account using the email address of an account that you can currently access
3. If prompted to go passwordless select Skip, any prompts for permissions can be denied
4. In a web browser, sign in to the My Sign-Ins website using your username in the format [email protected], SSO password, and MFA if it is already set up on your account
5. If account setup does not start automatically, select + Add sign-in method
6. Select Microsoft Authenticator > I want to use a different authenticator app > Next > Can't scan image?

7. Return to OneAuth, then from the menu bar select:
    

   Windows	OTP Authenticator > + Add new > Manual entry
   macOS	Authenticator > Add new > Manual entry
   iOS	Authenticator > Add new > Manual entry
   Android	Authenticator > Add new > Enter secret manually

8. Complete the displayed form with:
    

   Issuer Name	Oxford University SSO
   Username	Your username in the format [email protected]
   Secret Key	The secret key displayed on the My Sign-Ins website
   Choose Folder	My Accounts
   Choose Brand	Your choice of icon

9. Return to the My Sign-ins website, select Next then provide the 6 digit code displayed in OneAuth

Back up your secret key

Back up your key to allow it to be restored if you sign out of OneAuth or install it on a new device.

1. In OneAuth, from the menu bar select either OTP Authenticator or Authenticator
2. Select Back up Secrets > SET UP
3. Provide a recovery passphrase (minimum 8 characters)

Security key

A security key is a device you plug into your computer to authenticate your account.

Another MFA method must already be in place before you can add a security key. The setup of keys can vary slightly and may require you to use the Chrome, Firefox or Edge web browser.

1. In a web browser, sign in to the My Sign-Ins website using your username in the format [email protected], SSO password and MFA
2. Select +Add sign-in method > Passkey > Next
3. If asked where to save the passkey, choose Security key
4. Follow the on-screen prompts, selecting Allow if your browser requests extended key information

All support for security keys is provided by your local IT support team.

Phone call

Attention: This option is being retired

From 1 February 2027, the phone call method will no longer be available for Oxford SSO accounts. We advise users not to set this method up going forward. If you currently use this method, please ensure you have at least one alternative authentication method configured before this date to avoid disruption when signing in.

An automated call can be made to a land or mobile telephone number, prompting for the press of a specified key.

1. In a web browser, sign in to the My Sign-Ins website using your username in the format [email protected], SSO password, and MFA if it is already set up on your account
2. If you are also going use text messages for MFA, add it first
3. If account setup does not start automatically, select +Add sign-in method
4. Select one of the phone options, then provide the phone number to use
5. Select Call me > Next, then verify the call made to the phone

Text message

Attention: This option is being retired

From 1 February 2027, the text message method will no longer be available for Oxford SSO accounts. We advise users not to set this method up going forward. If you currently use this method, please ensure you have at least one alternative authentication method configured before this date to avoid disruption when signing in. 

A one-time password can be sent to a telephone number.

1. In a web browser, sign in to the My Sign-Ins website using your username in the format [email protected], SSO password, and MFA if it is already set up on your account
2. If you do not enter the account setup automatically, select +Add sign-in method
3. Select Phone, then provide the phone number to use
4. Select Text me a code > Next, then provide the 6 digit verification code sent to your device

Microsoft Authenticator

With internet access

1. When signing in to your SSO account, provide your username in the format [email protected] and SSO password
2. A two digit number will be displayed on screen, then Microsoft Authenticator will prompt for this
3. Provide Microsoft Authenticator with the two digit number

Without internet access

1. When signing in to your SSO account, provide your username in the format [email protected] and SSO password
2. Select I can't use my Microsoft Authenticator app right now > Use a verification code
3. Open Microsoft Authenticator
4. Select the account used for your SSO account
5. Provide the 6 digit verification code displayed by the app

Alternative authenticator

Accessing the one time passcode will differ slightly between different authenticator apps, but the general process would be:

1. When signing in to your SSO account, provide your username in the format [email protected] and SSO password
2. Open the authenticator app
3. Select the account used for your SSO account
4. Provide the 6 digit verification code displayed by the app

OneAuth

1. When signing in to your SSO account, provide your username in the format [email protected] and SSO password
2. Open OneAuth
3. From the menu bar, select either OTP Authenticator or Authenticator
4. Select the account used for your SSO account
5. Provide the 6 digit verification code displayed by the app

Security key

1. When signing in to your SSO account, select Sign-in options
2. Select Face, fingerprint, PIN or security key
3. If asked to sign in with your passkey, choose Security key
4. Follow the on-screen prompts

All support for security keys is provided by your local IT support team.

Phone call

Warning: Only approve notifications you initiate

1. When signing in to your SSO account, provide your username in the format [email protected] and SSO password
2. A call will be made to your nominated phone
3. Listen to the automated message and press the phone's hash/pound key # to confirm that you initiated this

You will have around 30 seconds to approve the message from the time you pick up the call.

Text message

1. When signing in to your SSO account, provide your username in the format [email protected] and SSO password
2. A 6 digit verification code will be sent to your nominated phone via WhatsApp, or text message if that is not available
3. Provide the 6 digit verification code

1. In a web browser, sign in to the My Sign-Ins website using your username in the format [email protected], SSO password and MFA
2. Select the Delete option, next to the method you want to remove

You should be able to switch between two separate organisation's logins, but if not you should be able to resolve issues if you clear your web browser's cache and cookies.

You can also keep logins separate by using:

• a different browser for each login, such as Chrome and Firefox.
• a private / incognito window for a second login.
• a separate browser profile for each login.

You will always be prompted for the most secure method you have added, the order of these being:

1. Security key
2. Microsoft Authenticator
3. Authenticator providing a one-time password
4. Text message or phone call