Body
Understanding Microsoft MFA and Passkeys
What is changing with Microsoft MFA? Microsoft is moving away from SMS text messages and voice calls for multi-factor authentication (MFA) and toward more secure authentication methods, including passkeys. If you currently use SMS or voice calls for MFA, you will need another supported authentication method.
What is a passkey? A passkey is a secure sign-in credential that uses your device or another supported security method to verify your identity. Depending on your device, you may use a PIN, fingerprint, facial recognition, or another device security method. Passkeys are designed to provide stronger protection against phishing and other attacks than passwords, text messages, and phone calls.
Is Microsoft Authenticator the same as a passkey? No. Microsoft Authenticator is an app that can be used for MFA and, on supported devices, can also store a passkey. A passkey is the credential used to verify your identity.
Do I have to use a passkey? No. A passkey is one of several available authentication options. Depending on your device and account configuration, you may be able to use:
- Microsoft Authenticator
- A passkey
- Windows Hello PIN
- Another supported authentication method
Can I have more than one authentication method? Yes. You can have multiple authentication methods available. For example, you could have Microsoft Authenticator and a passkey registered to your account. Having more than one method can help you maintain access if one method is unavailable.
Who Needs to Take Action?
Who needs to take action? You need to take action if you currently use SMS text messages or voice calls as your Microsoft MFA method and do not have another supported authentication method available. If you already use Microsoft Authenticator, a passkey, Windows Hello PIN, or another supported MFA method, you can continue using that method.
Can I still use SMS or voice calls right now? Yes, during the transition period. However, Microsoft is retiring these authentication methods, so users who rely on them should set up another supported method.
What happens if I do not set up another authentication method? If SMS or voice is your only available MFA method, Microsoft may require you to register another supported authentication method when you sign in. Setting up another method in advance helps you avoid losing access to your account.
Supported Devices and Authentication Options
What if I use a Mac? Additional information about authentication options for Mac devices will be provided in the coming weeks.
What devices and browsers support passkey?
Supported devices
- Windows 10 and newer.
- MacOS Ventura and newer.
- ChromeOS 109 and newer.
- iOS 16 and newer. Passkeys in Microsoft Authenticator require iOS 17 and newer.
- Android 9 and newer. Passkeys in Microsoft Authenticator require Android 14 and newer.
- Hardware security keys that support the FIDO2 protocol.
Supported browsers
- Microsoft Edge 109 or newer. Microsoft Password Manager is only available in Edge v142 and newer.
- Safari 16 or newer.
- Chrome 109 or newer.
For more details on passkeys, visit What are Passkeys and why do they matter?
Can I use Windows Hello? Yes. Windows Hello is available as an additional sign-in option on TWU-managed Windows computers. You can set up a Windows Hello PIN and use it to create a passkey for your Microsoft account. Windows Hello is also available on supported personal Windows 10 and Windows 11 devices. The available options may vary depending on the device and its configuration. See Configuring Windows Hello for instructions.
How do I set up a Windows Hello PIN on my TWU-managed computer? Click Start > Settings > Accounts > Sign-in options > PIN (Windows Hello) Select Set up and follow the instructions. Your TWU-managed computer must be connected to the TWU wired network or VPN to receive the policy that enables Windows Hello. The policy may take a couple of days to reach your computer.
Can I use my personal computer? Yes, supported authentication options may be available on personal devices. The available options depend on the device, operating system, browser, and account configuration. For example, a personal device may support a PIN, fingerprint, facial recognition, or another device security method.
Can I use my phone for authentication? Yes. You can use Microsoft Authenticator on a compatible mobile device. Supported mobile devices may also allow you to register a passkey.
What if I do not have a smartphone? You may have other authentication options, such as Windows Hello on a supported Windows computer or another supported authentication method. If you need help determining which option is available to you, contact the IT Solutions Service Desk.
Setting Up and Managing Authentication Methods
How do I know which authentication methods I currently have? You can review your registered authentication methods on the Microsoft Security Info page: Microsoft Security Info
What should I do before removing SMS or voice authentication? Set up and test another authentication method first. Do not remove your existing SMS or voice method until you have successfully configured another method. See Removing SMS or Voice Call as a Microsoft MFA Method for instructions.
Can I remove my phone number from Microsoft Security Info? Yes. You can remove an SMS or voice authentication method after another authentication method has been successfully configured. Removing a phone number from Microsoft Security Info removes it as an MFA method. It does not change your TWU telephone number or other contact information. See Removing SMS or Voice Call as a Microsoft MFA Method for instructions.
Troubleshooting and Device Changes
What if I get a new phone or computer? You may need to register an authentication method on your new device. If your passkey is stored only on your previous device, it may not automatically be available on your new device. You may need to register a new passkey or use another registered authentication method.
What if I lose my phone or another device? If you have another authentication method registered, use that method to sign in and review your authentication methods. If you cannot access your account, contact the IT Solutions Service Desk for assistance.
What if my passkey is not working?
Try the following:
- Make sure your device and browser are up to date.
- Make sure your device security method, such as a PIN or biometric sign-in, is working.
- Try another registered authentication method.
- Review your authentication methods on the Microsoft Security Info page.
If you still cannot sign in, contact the IT Solutions Service Desk.
For additional support, contact the Technology Service Desk at 940-898-3971, servicedesk@twu.edu, submit a request through the Technology Service Catalog.