How often is Multifactor Authentication required?
- Multifactor Authentication is always required when logging in with a new device or application.
- With applications such as Microsoft Outlook or Teams, the authentication is automatically remembered for 90 days.
- When logging in to Web services such as Outlook for Web, you can, when prompted for strong authentication, set your browser to remember your login for the next 90 days. The information is remembered by the browser cookie.
- Please note that if you exit the O365 service using the “Log out” link, this cookie will be deleted along with other login details and Multifactor Authentication will be required again the next time you log in.
Why is additional authentication constantly required when implementing Multifactor Authentication?
The purpose of Multifactor Authentication is to prevent logging in with stolen credentials. For this reason, additional authentication is always required when logging in with a new application. At the beginning, you will need to use additional authentication more often because different browsers, e-mail applications of smartphones or computers and other applications requiring authentication require their own login. The additional authentication is remembered for 90 days in each application.
The information about additional authentication is stored in browser cookies. Therefore, when using privacy mode or after clearing the browsing history, you will be asked for new authentication. Similarly, exiting the O365 service using the “Log out” link will result in the deletion of the authentication data and a request for authentication again the next time you log in. If the same application keeps asking for authentication over and over again, please contact the IT Helpdesk to resolve the issue.
Is the e-mail application X supported?
The recommended application for both mobile and desktop devices is Microsoft Outlook, and for browsers, Outlook for Web.
Multifactor Authentication requires the e-mail application to support OAuth2 login (also referred to as Modern Authentication). This is also supported to varying degrees by many other e-mail applications. E-mail has been known to work with the following applications, for example:
- Mac Mail from version 10.14 and iOS Mail from version 11.
- Alpine or Pine
- Instructions on the Cubbli developer wiki (page available only in English).
Note! In many cases, the e-mail account must be deleted and reinstalled in order to use the new login method.
How do I change the default method?
We strongly recommend using the Authenticator application as your default method. You can change the default method on the Security Info site.
The option to change the default method will appear on top of the Add method button once you have added another authentication method and then reloaded the Security Info site (press F5). For instructions on how to add authentication methods, see the Use and management of MFA methods page.
What authentication methods are supported?
Currently supported authentication methods:
- Microsoft Authenticator application. The recommended and preferred method to use your phone to confirm your login with a Yes/No question.
- Other Authenticator applications or devices that generate TOTP codes. These generate a numeric code that changes every 30 seconds and function on devices even without an internet connection. Enter the code to access the system.
- FIDO2 keys. USB/NCF keys that use a certificate-based solution in combination with a PIN code. Note: At the time of writing, the key cannot be enabled on Linux, but it can be used if it is enabled on another device.
- Phone call. An automatic telephone call to the number specified during setup, with instructions on how to use it. By pressing the # sign, the recipient accepts the login.
I don't have a work phone, how do I get Multifactor Authentication?
- Instructions for obtaining a work phone can be found in Flamma.
- If you do not want a work phone, you can also use the Microsoft Authenticator application and call identification on your phone.
- See also “I don't have a phone, what other options do I have for authentication?”
I don't have a phone, what other options do I have for authentication??
The recommended authentication methods are the Microsoft Authenticator application and a backup phone call. If these are not possible, applications that provide TOTP codes are also available for different operating systems. There is no official support from the university for these, and they are used under the user's responsibility. Commonly used applications include:
- There are various TOTP applications for mobile devices, such as andOTP (android), FreeOTP (Android/iOS) and Google Authenticator.
- KeePassXC Password Safe, available for different operating systems, incl. Linux, macOS and Windows.
- Authenticator plugin for your browser.
- WinAuth application for Windows.
- oathtool command line application for Linux.
To add an app using a TOTP code on the Security Info site, select Add method > Authenticator App > I want to use a different authenticator app.
What are the safest authentication methods?
The most secure methods are considered to be the Microsoft Authenticator application when the app uses key lock or biometric authentication, as well as FIDO2 keys with a PIN code. These tools alone meet the definition of Multifactor Authentication and may allow login without a password in the future.
I no longer have access to the MFA method I used. What should I do?
Note! Remember to register at least two separate authentication methods, so that if you lose one, the other is still available.
- You can reset all MFA methods at https://mfa.it.helsinki.fi, where your identity if verified using your Suomi.fi-identification. After this, you will be required to register the authentication method at the next login.
- If you are unable to use Suomi.fi identification, contact the IT Helpdesk to reset your MFA methods.
- After resetting, your old MFA methods will still be visible on the Security Info page, but they will no longer work. You can re-enable MFA methods by selecting “Enable two-step verification” next to the method or by re-registering the method.
- Note! Resetting your MFA methods will not log you out of software or user sessions. If your ID has fallen into the wrong hands, the sessions must be logged out separately on the Security Info page https://mysignins.microsoft.com/security-info.
I’m unable to sign up or log in because the browser gets stuck and nothing happens
Try using your browser's privacy mode (privacy, incognito) and/or a different browser. If this works, the problem is either caused by a browser plugin or by cached data. In this case, disabling browser plugins or clearing the browser cache is likely to help. Read the IT Helpdesk instructions for clearing the cache.
The service says that the call was not answered even though my phone did not ring at all
Check the call log to see if you received a call and that the number is not on the blocked list. MFA requests come from US numbers +1 866 539 4191, +1 855 330 8653 and +1 877 668 6536.
In some double SIM phones, the problem is that the other SIM card sometimes drops off the phone network and the call is directed to the answering machine. These are usually smartphones where authentication is best done using the Microsoft Authenticator application.
You can also authenticate using the number of the subscription that has active mobile data.
The service says the TOTP code is incorrect even though it isn’t
As TOTP codes have a time limit, just a few seconds of discrepancy prevents the code from working for the entire 30 seconds of its validity. Check the time on the device issuing the code.
I attempted phone authentication and the system says "Request failed due to exceeding the number of allowed attempts".
Phone authentication allows five unsuccessful attempts within an hour, after which the authentication method is locked for 24 hours. The only way to log in during this time is to use other authentication methods, such as the Authenticator application.
Registering an authentication method gives an error message “You are blocked from performing this operation. Please contact your administrator for help.”
Managing authentication methods has been blocked due to suspicious behaviour, usually resulting from several unsuccessful attempts to register an authentication method. Please contact Helpdesk to remove the block.
After the MFA has been implemented, the e-mail application says “You are receiving this message because your e-mail has been disabled by your IT department.”
The application does not support the OAuth2/Modern Authentication method required by MFA or is unable to switch to it automatically. If the app should support this login method (e.g. iOS Mail), deleting and resetting your account may help. Otherwise, you'll need to use another app. We recommend using the Microsoft Outlook application for e-mail on your mobile.
Issues not mentioned above
Try using the browser's privacy mode (incognito) and/or another browser. If this works, the problem is either caused by a browser plugin or by cached data. In this case, disabling browser plugins or clearing the browser cache is likely to help. Read the IT Helpdesk instructions for clearing the cache. If this does not help, please contact IT Helpdesk to resolve the problem.
The instructions site of the University of Helsinki's IT Helpdesk helps you with IT-related issues related to your work. Let us know how we can improve our instructions. We greatly appreciate your feedback!How would you improve these instructions?