Multi-Factor Authentication (MFA) Changes

A passkey is a secure replacement for a password. It lets you sign in using your fingerprint, face recognition, PIN, or a security key, making it easier and more secure to access your account. Passkeys are more secure because they cannot be guessed, reused, or stolen through phishing attacks in the same way passwords and text messages can.

The National Cyber Security Centre explains all about passkeys.

Microsoft is encouraging everyone to set up a passkey as this method is more secure. If you use voice (phone call) or text message as your primary or only authentication method, you must set up a more secure authentication method before 1 February 2027. 

If you use voice (phone call) or text message as your primary or only authentication method, you must set up a more secure authentication method before 1 February 2027. If your secondary authentication method is voice (phone call) or text message, you will also be prompted to set up a more secure method. 

Everyone with text message or phone enabled as their primary or secondary authentication method should set up a more secure authentication method such as a passkey in Microsoft Authenticator.

You can view and manage your registered authentication methods by visiting the Security Info page . 

The Security Info page allows you to: 

• View the authentication methods currently registered on your account.
• Check whether text message or voice authentication is configured.
• Add or remove authentication methods.
• Register a passkey, including a passkey in Microsoft Authenticator.
• Review which methods you can use to verify your identity when signing in. 

Yes, students who use text message or voice (phone call) authentication methods to log in at Oxford also need to more to a more secure authentication method.

Single Sign-On (SSO) login to university systems requires multi-factor authentication. If you only use voice (phone call) or text message, these methods will not work from 1 February 2027, meaning you may not be able to access the systems you need for your work or study.

When you try to set up a passkey you may find that the operating system for your mobile device is too old to support it. In this case, you should get a notification to let you know. Please explore alternative authentication methods, and consider upgrading to a newer device that supports the most secure methods of MFA if possible, for any devices connected to University accounts.