How to manage your SSO password

Your Oxford username and SSO account are created after your University card record is added.

Your account must then be activated with an activation code. Student activation codes are sent to their external email address, whilst staff codes are issued by their local IT support team, If you do not receive an activation code, please contact your local IT support team.

The activation code has a format similar to ABCD-EFGH-IJKL. If your code expires before activation, please contact the Central IT Service Desk.

To activate your account, from our WebAuth page select Activate your account, then provide your:

• Last Name, surname
• Date of birth, in the format 1 January 2000
• University card number or student number, 7 digit number

Then your:

• Oxford username, in the format abcd1234
• Account activation code, 12 character code

Then your new password, requirements for this are shown on the page:

• Password, your new password
• Repeat Password, to check it was typed correctly

Finally, you will need to set your security question.

You are automatically prompted to set a security question when you activate your account. This security question provides additional verification if you ever need to reset your SSO password.

Your security question should be chosen carefully as the answer must be easy to recall and not change over time, but very hard to guess or find out. Obscure trivia from your childhood may be good, though only if not discoverable from publicly available records or websites such as Facebook or LinkedIn. You could also make the question a little cryptic, as long as it will still be understood in a few years time.

A good security question may be:

• My favourite teacher's nickname
• The name of my oldest cuddly toy
• Sammy's passion

However, a poor security question may be:

• My favourite colour [too few answers]
• My favourite food [may be guessable or known by others]
• My favourite movie [could change over time]
• Our Anniversary [dates can be formatted in many different ways]

You should also not use a security question that is used anywhere else.

You will be prompted to set up multi-factor authentication (MFA) the first time that you sign in to a service with your SSO details.

Each time you provide your username and password to access your account, additional confirmation is required from a device that only you would have access to. This may be performed in various ways, such as by providing a code from a mobile phone app, providing a code sent to a registered mobile phone, or receiving a call on a specific landline.

You must update your SSO password at least once a year, or earlier if you suspect that anyone else may know it.

To update your password, from our WebAuth page select Change your password, then provide your:

• Oxford username, in the format abcd1234
• Old password, the current SSO password
• New Password, the new SSO password
• Re-enter new Password, to check it was typed correctly

The requirements for the new password are displayed on the page.

If you are unable to provide your current password, you will need to reset your SSO password.

A verification step when you reset your SSO password is that you must correctly answer your account's security question. If you have not set a security question, forgotten its answer, or provided three incorrect answers, you will first need to reset your security question.

To reset your SSO password, from our WebAuth page select Reset your password, then provide your:

• Last Name, surname
• Date of birth, in the format 1 January 2000
• University card number or student number, 7 digit number

Then your:

• Oxford username, in the format abcd1234

Then the:

• Answer, to the security question

Then your new password, requirements for this are shown on the page:

• Password, your new password
• Repeat Password, to check it was typed correctly

If you have not set a security question, forgotten it, or provided three incorrect answers, you will need either the current SSO password or a rescue code to reset it. To request a rescue code you can contact your local IT support team, or contact the central IT Service Desk. The rescue code will expire after seven days.

To update your security question, from our WebAuth page select Set a security question and/or answer, then provide your:

• Last Name, surname
• Date of birth, in the format 1 January 2000
• University card number or student number, 7 digit number

Then your:

• Oxford username, in the format abcd1234
• Password or Rescue code, SSO password or 12 character code

Then your new security question, assistance for this is provided in the Set your security question section:

• Security question, the question to prompt you with
• Answer your new answer
• Repeat answer, to check it was typed correctly

The security question can now be used to reset your SSO password.