Multi-factor Authentication FAQs

• What is MFA?

  Multi-factor authentication (MFA) provides an extra layer of security before signing into an online service. MFA helps ensure that you are the only person who can access your account(s), even if someone steals your password. For certain applications at CWU, you will log in using your MyCWU login information and as a second step, reconfirm your identity using a verification device of your choice, like a phone or tablet.

  MFA is critical in preventing unauthorized access to personal and institutional information if your password is compromised. CWU Information Services & Security staff are working to integrate MFA into the services utilized by the Wildcat community.

• How do I setup MFA?

  View our step-by-step guide.

• The Microsoft Authenticator app isn't working

  • Make sure you have notifications enabled on your cell phone.
  • New cell phone? This is why you are no longer getting notifications. The Change Preferred Knowledge Base article will walk you through how to set up your new phone and get you up and running again.
  • If you'd like to reset MFA, you can view our self-service tool, click Troubleshoot MFA, sign in using your CWU credentials, and click Reset MFA to restart the MFA setup process.
  • Make sure you have updated to the latest version of the Microsoft Authenticator app.
  • You can use the One-Time Password code function of the Microsoft Authenticator app.

• What are my options for MFA?

  Your options for MFA include:

  • A notification or code generated by the Microsoft Authenticator app.
  • A phone call

  The Information Services & Security department strongly recommends the use of the Microsoft Authenticator app. We have found that this is the simplest method for community members to use. The Authenticator app also generates a code that can be used if you lose cell or wireless networking services. This is ideal if you are in an area with poor or no cell coverage. If you tend to carry your smart phone, this is the preferred method.

• How do I use MFA when traveling?

  You will want to set up the Microsoft Authenticator app on your phone when traveling. The app can be used even if you lose cell and wireless networking connectivity. Every 30 seconds, the app generates a verification code. To view the code you can open the Microsoft Authenticator app, tap on your account, and view a one-time password code. When authenticating, you may have to choose the option to "sign in another way" after entering your password to be prompted to authenticate with the one-time password code. Enter the most current verification code on the sign-in screen.

• Will MFA work on my phone if I lose cell service and wireless networking?

  If you have installed the Microsoft Authenticator app on your mobile device, you can open the application, tap on your account, and view a one-time password code. Every 30 seconds, the app generates a verification code. You can use this code without cell service. When authenticating, you may have to choose the option to "sign in another way" after entering your password to be prompted to authenticate with the one-time password code. Enter the most current verification code on the sign-in screen.

   

• I am not getting a notification or phone call for MFA

  Did you get a new Cell Phone? 

  If so - go to "The Microsoft Authenitcator app isn't working" for instructions on how to setup your new cell phone.

  Notification:

  Make sure you have notifications turned on, and make sure you are using the latest version of the Microsoft Authenticator app.

  Apple:

  1. Go to Settings.
  2. Tap Notifications.
  3. Select the Authenticator App under Notification style.
  4. Choose to Allow Notifications.

  Android:

  1. Go to Settings.
  2. Tap Notifications.
  3. Select App notifications.
  4. Tap the Authenticator App.
  5. Choose to Allow notifications.

  Phone call:

  Make sure you haven't blocked the following numbers:

  +1 (866) 539 4191, +1 (855) 330 8653, and +1 (877) 668 6536.

  In the United States, voice calls from Microsoft come from those numbers.

  Apple:

  1. Go to Settings.
  2. Tap Phone.
  3. Select Blocked Contacts.
  4. Click Edit on the top right-hand corner.
  5. Tap the minus (-) sign next to the number to unblock.

  Android:

  1. Go to the Phone app.
  2. Tap the 3 dots in the top right-hand corner.
  3. Select Settings.
  4. Click Block Numbers.
  5. Next to the number you want to unblock, click Clear.
     1. Clear might be a minus (-) sign or an (x).
• How do I change or update my authentication method?

  View the how-to guide on managing authentication methods.

• What if I forget my mobile device at home or lose my device?

  If you lose your device and can't access your account, you may use CWU's MFA help tool to put yourself in MFA bypass. To do this:

  1. Visit CWU's MFA troubleshooting site
  2. Click Troubleshoot MFA
  3. Sign in with your CWU credentials
  4. Select Request Bypass
  5. Your account won't request MFA for the next 48 hours

  If you lost your device, and have another device to setup MFA:

  1. VIsit CWU's MFA troubleshooting site
  2. Click Troubleshoot MFA
  3. Sign in with your CWU credentials
  4. Select Reset MFA
  5. After a few minutes, your account will request that you setup MFA

  If neither of those options work for you, please contact the Service Desk via email at CWU.ServiceDesk@cwu.edu or via phone at (509)963-2001 and we will help you.

• Should I register more than one device?

  Yes. CWU recommends that you register more than one device. You may add, remove, and manage your authentication methods, and devices at any time.

• Can I use my personal smartphone, tablet, or mobile phone for MFA?

  Yes! The university values personal choice and recognizes the convenience of using a personal device for MFA

• Can employees use a personal device for MFA, even for conducting university business?

  Yes! Employees can use a personal device for MFA, even for university business. A personal device enables safe and convenient multi-factor authentication to systems used to conduct university business. "Bring your own device" (BYOD) is a common operational model that acknowledges trends in society toward use of personal devices for user authentication.

• How can I troubleshoot my MFA access?

  If you run into issues with Multi-factor Authentication, please view our decision tree. Our decision tree provides step-by-step instructions on how to troubleshoot your MFA access.

• Will my personal device be subject to a public records request because it is used for MFA?

  No. If you use the Microsoft Authenticator app, there will be no record on your device. All authentication records are stored in the Microsoft Azure cloud, and any information on your personal devices would be redundant.

• Why is the Microsoft Authenticator app requesting a 4-digit pin?

  Microsoft Authenticator enables app lock by default. App lock uses your phone's security features. So, in addition to unlocking one's phone, one must also unlock the Microsoft Authenticator app. For example, if you use a 4-digit pin to secure your phone, you must use that same 4-digit pin to unlock the Authenticator app.

  You may disable Microsoft's Authenticator app lock by following these steps:

  1. Open the Microsoft Authenticator app.
  2. In the top right hand corner, select three horizontal dots.
  3. Select Settings.
  4. Under Security, toggle App Lock to off.

  You may also view our more detailed instructions on how to disable the app lock on the Authenticator app.

• Why does my Authenticator app display advertisements?

  If your Authenticator app displays advertisements, then you are using a third party's authenticator app. CWU strongly recommends Wildcat community members use the Microsoft Authenticator app. The Microsoft Authenticator app does not display advertisements.

  You may view our how-to change your MFA method guide. This guide will guide you step-by-step on how to add a different method, such as the Microsoft Authenticator app, and remove the third party authenticator app.

• What applications require MFA?

  • MyCWU
  • Canvas
  • Microsoft Office products
  • And several of our web-based single sign-on applications

• How often do I have to re-authenticate?

  MFA will prompt you to authenticate once every 21 days for most CWU systems. You may be prompted more frequently if you use VPN, if you use more than one computer, or if you frequently clear your browser cache.

• I don't have anything confidential in my account, why should I care about MFA?

  Most attackers are interested in using your username and password to send out hundreds or thousands of phishing messages to other faculty, staff, and students in an attempt to compromise their computers and get access to sensitive information. Another very common tactic is for hackers to alter your direct deposit information so your paycheck or, if you are a student, financial aid is deposited into their account instead of yours.

• What are the benefits of using MFA?

  The main benefit of using multi-factor authentication is a significant increase in protection of your account. If you receive a security code or push notification when you are not trying to log in to your account, you'll immediately know that someone else is attempting to do so. If this does happen, you should change your password and call the CWU Service Desk at 509-963-2001. The Desk is available Monday through Friday from AM to PM. Outside these hours use the Help.CWU.EDU link and select Troubleshoot MFA to reset your MFA methods to secure your account. 

  • Two-factor adds an extra barrier between your personal information and the malicious people.
  • Two-factor can help keep attackers from accessing your email, documents, financial, personal, and health information, or research data.
  • Two-factor reduces the risk of hackers using your MyCWU account to perform harmful activities.
  • Two-factor helps protect CWU's systems.