Multi-factor Authentication (MFA) FAQ

 

What is Multi-Factor Authentication (MFA)?

Multi-Factor Authentication helps validate who you are by adding a second step sign in process.

  • Something you know (your StFX password)
  • Something you have (a time based passcode or notification from your mobile device or hardware token)

This creates a layered defense, preventing further unauthorized access from your StFX account if your password is compromised.

How does Multi-Factor Authentication help protect my data and StFX?

Multi-factor Authentication makes it more difficult for someone else to sign into your Microsoft (Office) 365 account or access StFX systems on VPN, even if they have access to your password. When someone attempts to sign in from a device or location, you will be required to verify the sign in attempt via your preferred verification method. An intruder would need to know your password and have access your verification device to sign in.

When will I need to use Multi-Factor Authentication?

 StFX accounts will be prompted for M365 MFA when accessing Microsoft services. Verification is not required when using classroom and lab computers.  Users of FortiClient VPN will be prompted each time they login to the VPN, on or off campus.

Microsoft 365 (M365) MFA

 

Forticlient VPN MFA 

 

  • M365 Applications

    • StFX Mail

    • Onedrive,

    • Teams

    • Word, Excel, Powerpoint etc...

  • Moodle

  • Banner Self Service & Banner Admin Pages

  • Reporting - Mydata and X-Reports

  • Other Services that use the Microsoft login such as;

    • Qualtrics

    • TeamDynamics - Viewing secure knowledge base articles and submitting/viewing tickets at services@stfx.ca

    • Drupal Website Editing

    • MyLabApps

 

  • On Campus

    • Banner Admin Pages

    • KX in buildings other than Keating Centre

    • OneSolution

  • Off campus access of Fortinet VPN for

    • Mapping Network drives

    • Accessing Smart Filter Reports (Finance applications)

    • KX off campus and in campus buildings outside of the Keating Centre

    • Banner Admin Pages

    • OneSolution

 

Is it mandatory to use MFA?

Yes, all StFX accounts will be required to use Multi-Factor Authentication for Microsoft 365 and VPN, and additional services will be added in the future.  MFA is a foundational cybersecurity practice in use for employees across industries and public sector institutions.  

You likely already use MFA for other personal accounts without realizing it like:

  • Using your bank card + a PIN to withdraw money from a bank machine
  • Entering a password + a code sent to your phone to access an online account

 

What account verification methods are available?

Microsoft 365 MFA

Microsoft Authenticator App 

  • Authenticator applications downloaded on your mobile device.  
  • Authenticator applications do not require WiFi or data.
  • Passwordless, OFT and notification options 

Mobile Device SMS (Text Message) Retiring in Feb 2027

  •  A verification code is sent to your mobile device to be transferred into the system you are logging into
  • This option does require data or WiFi

Mobile Device Phone Call -Retiring in Feb 2027

  • Phone call places an automated voice call to the phone number you provide. Answer the call and press the pound key (#) on the phone keypad to authenticate.
  • This option does require an active phone number (SIM)
  • StFX office phone numbers should not be used as they are not accessible off campus

Hardware Token

  • StFX employees without a mobile device will be provided with a physical key chain like device which provides a verification code to validate your identity.  
  • If you do not have mobile device, a hardware token will be the method for verification. 
  • An option when traveling and if not taking a mobile device but accounts will need to be configured prior to leaving and returning
  • Hardware token users can not use this as a back up method, it's mobile or hardware.

 

VPN MFA

FortiToken Authenticator App 

  • FortiToken Authenticator application is the only software-based authenticator option for VPN MFA.  It can be downloaded on your mobile device.  
  • Authenticator applications do not require wifi or data. 

Hardware Token

  • StFX employees without a mobile device will be provided with a physical key chain like device which provides a verification code to validate your identity.  
  • If you do not have mobile device, a hardware token will be the method for verification. 
  • An option when traveling and will not taking a mobile device.

External emails are not a secure method for verification therefore can not be used as method for MFA.

How do I choose what type of authentication method is right for me?

Choosing between using a hardware token and a mobile token is the 1st decision you need to make.  A mobile token will be an app installed on your mobile device.  A hard ware token is a key chain like device that you will need to use to access your code.  

 

If you do not have a mobile device you will need to have a hardware token. StFX members can request a hardware token be assigned.  Once a hardware token is configured for your account it will become your default method of MFA. If using for VPN it will void your mobile token.

 

Request a Hardware Token

 

MFA Authentication Method Feature Summary

 

Method

M365 MFA

VPN MFA

Req's Mobile

Data/Wifi/SiM

Notes

Microsoft Authenticator App - Passwordless

 

  • Perferred Method for M365 MFA

  • Enhanced security against account compromise

  • Reduced risk of phishing attacks

  • Ability to approve sign-ins with a simple notification or use passwordless authentication creating a faster sign-in process

  • Your Mobile device must be available and will be registered to your M365 account

  • Can be configured on multiple devices

Microsoft Authenticator App - Code Method

 

 

  • Will not work with VPN MFA

  • Some M365 accounts have this configured on first login

  • Great option for traveling with a device with no data or switched out SIM

  • Your Mobile device must be available

Microsoft Authenticator App - Notification

 

  • Convenient method for authentication as there is no code transfer, notifications will pop up on your mobile device and you choose approve or deny

  • Does require mobile device to be connected to data or wifi

**FortiToken Authenticator App

 

  • Can be set up for both M365 and VPN MFA

Phone (Call) (Microsoft Retiring Feb 2026)

 

  • Automated recording will call your phone and prompt you to press #

  • Office phones are not recommended as they are not accessible off campus

**Mobile Phone (SMS, Text message) Retiring Feb 2026

 

  • Should be configured if possible on M365 as a backup method if not the primary

  • Does require mobile device to be connected to data or WiFi

Hardware Token

 

 

  • Requires a code to be input into your log in device from a token device

  • Battery can die

  • Device must be carried with you to access account

  • Visually impaired options available

 

Can I use personal phones for MFA?

If a personal cell phone is something that you carry with you through out your work day, you may find it more convenient to use it for MFA rather than having to add a hardware token to the items you always have on you.

 

What are the mobile device requirements?

To use MFA authenticator applications ensure your mobile device is running, IOS 11.0 or higher, Android 6.0 or higher, Windows Phone 8, 8.1 Windows 10 & Windows universal platform.

 

I already use an authenticator app, can I continue to use it?

Microsoft 365 MFA can be used with most authenticator applications. You can continue to use your preferred authenticator app, keeping in mind that IT Services will only be supporting the recommended applications.  If you are a VPN user you will need to use the FortiToken Authenticator. 

 

I login with the same device every day – do I still need MFA?

Yes you will be asked to MFA at each login and for the VPN you will need to use MFA every time you connect.

 

What happens if my mobile device is damaged,wiped or replaced?

You can reach out to our Helpdesk and we following an online id verificaiton through our live chat we can clear your old methods.  If you will be without a device a temp alternative of One time password can be issued as a form of MFA. 

I'm going to be traveling, how will this work for me?

If you travel with your mobile device setting up an authenticator app is recommended method.  An authenticator apps works similar to a hardware token where a large number of codes are cycled through a timed based sequence.  There is no need to have WiFi or data on your phone to use this option so it's a perfect fit for those who swap out their SIM cards when traveling.

If you do not travel with your mobile device and need access to StFX services while away you will need to request a hardware token prior to traveling.

 

I received a notification to approve a sign in when I wasn’t trying to log in to a service. What should I do?

Do not approve the sign-in.   Someone might be trying to log in to your account as you.

You can review your Microsoft 365 sign-ins at any time in your account portal (https://myaccount.microsoft.com) - click ‘My sign-ins’ in the menu. These details can help you figure out if the device attempting to log in is yours.

 

Print Article

Related Articles (1)

Managing Security information for MyPassword and Microsoft 365 MFA
In the case of a forgotten password or compromised account it is important to have external contact methods that can be used to restore your account.

Related Services / Offerings (1)

MFA -Multi-Factor Authentication
StFX leverages multi factor authentication for Office 365 Services and VPN to protect personal data and University data.