Body
‼️ SMS and phone call methods will stop working February 1, 2027. Users who rely on those methods will need to add other methods before then.
This guide covers available methods and configuration steps for Multi-Factor Authentication (MFA / 2FA) which adds extra steps to verify your identity.
All SUNY Geneseo account holders—students, employees, vendors, and generic accounts—must set up MFA on their Geneseo Microsoft account, which protects most campus services.
Adding MFA methods
ℹ️ We recommend adding multiple MFA methods to your Geneseo Microsoft account. You want to be able to still get in even if your primary authentication device (usually smartphone) is unavailable. If you have no usable MFA methods and are locked out, call the CIT HelpDesk at 585-245-5588 to verify your identity and restore access.
-
Access your Microsoft security info
-
To add a method, click + Add method.
-
Select the type of method you want to add.
-
Follow the prompts for the selected method. See below for method-specific instructions
Passkeys
Passkeys are a modern alternative to passwords that are resistant to phishing. They contain metadata about the user and the service the passkey was created for, and as halves of a digital key that uniquely match each other. One half of the key and its metadata are stored by the user in a passkey manager, or in a physical device like a Security Key; the other half is stored by the service. During passkey authentication, the user's passkey manager or security key attempts to mesh their half of the user-selected key for that service with a corresponding half in the service's passkey database. If a match is found, authentication succeeds.
Some services that request passkey authentication early in the sign-in process are now able to parse the username from passkeys, avoiding the need to type your username. Microsoft tries to follow your most recent sign-in method; if you sign-in with a Passkey, on your next sign-in it will skip requesting your username and prompt you for Passkey authentication. See the "Change Your Default MFA Method" section below for more info.
CIT is internally piloting a passkey registration nudge during Microsoft sign-ins. This will eventually roll out to all Geneseo Microsoft accounts.
Geneseo recommends adding at least one synced passkey to your Geneseo Microsoft account, saved in a passkey manager you're able to access even if your primary mobile device is lost, stolen, or replaced. Many password managers can also function as passkey managers, which is another reason why we recommend them. Popular examples of passkey managers are Apple's iCloud Keychain, and Google's Password Manager in Chrome and Android.
Geneseo also recommends giving descriptive names to all registered passkeys to help you distinguish between them:
- Synced passkey? We recommend naming it after the passkey manager it was saved to and the account signed in to that passkey manager
- Example: "iCloud nuttysquirrel@gmail.com"
- Device-bound passkey? We recommend naming it after the device, with a rough date of creation
- Example: "Yubikey Blue October 2026"
Microsoft-Specific Passkey Gotchas
- Microsoft Account passkeys must be saved in a system protected by a passcode/PIN, passphrase, or fingerprint/face scan (biometric). For example, if your phone does not yet have a passcode, you will be required to create one before Microsoft will allow you to create a passkey on that device..
- If you get an error during passkey creation immediately after configuring one of these methods, please try again to create a passkey.
- Microsoft supports most platform and browser combinations (but not all).
- On Android, Microsoft only supports passkey creation in Google Chrome and Microsoft Edge.
Synced Passkeys
Synced passkeys are a type of passkey that may be copied to other devices. Synced passkeys are usually backed up to the cloud, so users don't lose access if they lose a single device. Examples of synced passkey managers are Apple's iCloud Keychain and Google's Password Manager built into Chrome and Android.
CIT recommends using a personal, non-Geneseo account when setting up a synced passkey manager, or password manager than supports passkeys. This helps ensure you don't lose access to created passkeys when you leave Geneseo!
Microsoft's instructions for creating a synced passkey are here.
Device-Bound Passkeys
Device-bound passkeys are a type of passkey that cannot be copied to other devices. The most popular of these are physical Security Keys: devices that store passkeys and require user intervention to unlock and access. The most popular Security Keys are the Yubikey Security Key Series. Newer versions of Microsoft Windows 11 contain an integrated device-bound Passkey manager.
Microsoft's instructions for creating a device-bound passkey are here.
Microsoft Authenticator App
The free Microsoft Authenticator app (available for iOS and Android devices) is an app-based authentication method that sends a notification to your device to approve your sign-in attempts. The app also provides a rotating 6-digit code of the same type as the "Other Authenticator Apps" section below.
We no longer encourage this app as your primary method because the trust relationship does not survive phone replacement or wiping. Many Geneseo accountholders have been locked out when they got a new phone because they didn't realize Microsoft Authenticator would not transfer its data over to the new phone, and they lacked additional MFA methods that didn't rely on their phone. For this reason we also do not allow Geneseo users to save passkeys in Microsoft Authenticator.
Please see Microsoft's official Authenticator App method documentation for instructions on adding this method to your account.
If you receive a notification when you are not attempting to log in, deny the request and use the 'report as fraud' function within the app.
"Other" Authenticator Apps - Time-Based One-Time Password (TOTP)
This method refers to apps that support 6-digit codes that rotate every 30 seconds, otherwise known as Time-based One-Time Password (TOTP). The initial setup is usually performed by scanning a QR code, but can also be completed by copy/pasting or typing the secret key, depending on your authenticator app.
Like passkeys, this method is often supported in password managers.
The following popular apps support this method:
Add a TOTP method by going to your Microsoft Security Info page, then:
-
Click + Add method
-
Select the Microsoft Authenticator option
-
This may sound counterintuitive - why would we ask you to select this option if you're not going setting up Microsoft Authenticator? This is a textbook example of a dark pattern, something Microsoft uses here to attempt to trick people into thinking they need to use Microsoft Authenticator.
-
Click I want to use a different authenticator app
-
Click Next
-
Follow the instructions from your other authenticator app for reading the QR code. Once your app displays a 6-digit code for this new account, click Next
-
Enter the 6-digit code displayed in your other authenticator app when prompted by Microsoft, and click Next. This confirms to Microsoft that your other authenticator app correctly parsed the secret information in the QR code.
Phone Verification (Option to end February 1, 2027)
For US phone numbers, located in the US only, Microsoft will call your phone number and prompt you to approve your pending sign-in.
Please see Microsoft's official phone method documentation for instructions on how to add this method to your account.
Text (SMS) Message (Option to end February 1, 2027)
For US phone numbers, located in the US only, Microsoft will send a text (SMS) message with a code to be entered in the login window.
Please see Microsoft's official SMS method documentation for instructions on adding this method to your account.
Remove MFA Method
-
Access your Microsoft security info
-
Find the method you want to remove in the list and click the delete option
Change your default MFA method
ℹ️ If you authenticate with a modern method like Passkeys, Microsoft will present that as your default method for future sign-ins. This overrides your default selection above. If you want to go back to your selected default, sign-in to Microsoft with your password and complete MFA.
-
Access your Microsoft security info
-
Click Change
-
Select the method you would like to use from the drop down menu
Troubleshooting and Questions
Why are we requiring people to use MFA?
We are required to use MFA by SUNY security guidelines. Our systems are under constant attack. The most common are password spray attacks, where attackers send thousands of logins using usernames and passwords harvested from the web, and phishing attacks, where attackers attempt to get your username and password. Multi-factor Authentication stops many of these attacks.
Your Pa$$word Doesn't Matter is a blog post that outlines Microsoft's research across millions of logins, explaining why passwords are insecure and how MFA results in protecting against all but the most targeted attacks.
What logins will require MFA?
Logins to most Geneseo web-based services and Microsoft's OneDrive and Office require you to sign in and use MFA at least every 14 days. Sign-in frequency varies between services based on security and vendor requirements.
What if I forgot my primary authentication device?
Please make sure you add MFA methods to your account that don't rely on your primary authentication device! If so, when prompted to sign in, click on the Sign in another way button and select a method you can complete.
What if I lose my phone or authenticator app?
You should notify the CIT HelpDesk immediately if you lose your phone or authenticator.
Should I take any precautions regarding the security of my MFA-enrolled smartphone or tablet?
Yes. Using a device for multi-factor login comes with the obligation to take reasonable precautions to protect it. Such precautions normally include using a password or a PIN to unlock the phone and maintaining current versions of your device's operating system and Authenticator App.
Can I use a different authenticator app (like Google Authenticator)?
Yes. Third-party apps such as 1Password, Authy, or Google Authenticator can be used as a software token to generate an OATH verification code. Users may have a combination of up to five OATH hardware tokens or authenticator applications, such as the Microsoft Authenticator app, configured for use at any time.
What if I get an authentication notification that I didn't expect?
You should report all messages that you did not generate. This may be a sign of someone attempting unauthorized access to your account, and your password may be compromised. Deny the notification and then confirm that it’s a fraudulent attempt. You should change your Geneseo password after reporting the fraudulent login attempt. Note: the authenticator app will warn you that reporting a fraudulent attempt may cause your account to be blocked or disabled, but this will only occur if you do not change your password promptly.
Why does the Microsoft Authenticator need to access my camera?
The Microsoft Authenticator needs access to your camera to take a picture of the QR code (a barcode-looking square) on your screen. It does not use camera access for anything else.
Does the Microsoft Authenticator track me?
The Microsoft authenticator does not track you or log location data. The only push notifications it will ever send are approval requests for logins to Geneseo systems. The Microsoft Authenticator does not give CIT or Microsoft access to any data or information on your device.
I don't have access to anything important why do I have to use MFA?
You may not think you have access to any information worth protecting, but all our faculty and staff have access to secure information of one kind or another, from your W-2 (which an attacker could use to commit fraud and receive your tax return) to student health data, FERPA-protected student data, or college financial data.
If your Geneseo account is compromised, it could also be used to trick other Geneseo staff into responding to a phishing email. Your account can also allow an attacker to more easily access systems or compromise users who do have access to the data they are looking for.
Still Need Help?
Ask CIT! 📞 (585) 245-5588 | 📧 Email | 💬 Chat | 📝 Submit a Request and we'll be happy to assist you.