Multi-Factor Authentication (MFA) - Revision history

Admin at 09:35, 7 July 2020

2020-07-07T09:35:33Z

← Older revision		Revision as of 11:35, 7 July 2020
Line 1:		Line 1:
	== Multi-Factor Authentication (MFA) ==		= Multi-Factor Authentication (MFA) =

	In 2020 Imperial will be making MFA compulsory on some sensitive services, such as Office 365, and will roll it out to other services as the need arises. Their overview and reasoning is here:		In 2020 Imperial will be making MFA compulsory on some sensitive services, such as Office 365, and will roll it out to other services as the need arises. Their overview and reasoning is here:

Admin at 09:30, 7 May 2020

2020-05-07T09:30:18Z

← Older revision		Revision as of 11:30, 7 May 2020
Line 24:		Line 24:
	Once you've made your app password for your non-MFA app, you can log in with your usual account and the app password you just created (not your usual Imperial password!).		Once you've made your app password for your non-MFA app, you can log in with your usual account and the app password you just created (not your usual Imperial password!).

	The other most common reason is that your phone has poor signal. Sometimes you can try to log in and get your MFA prompt, only to find your phone doesn't get a code. This makes you try to log in again, and you still don't get a code. You try a third time and suddenly your phone gets three codes! Only enter the latest code, the previous ones are invalid. You probably think this is annoying, but after all if you have no signal you're not going to be able to use the service anyway.		The other most common reason is that your phone has poor signal. Sometimes you can try to log in and get your MFA prompt, only to find your phone doesn't get a code. This makes you try to log in again, and you still don't get a code. You try a third time and suddenly your phone gets three codes! Only enter the latest code, the previous ones are invalid. You probably think this is annoying, but after all if you have no signal you're probably not going to be able to use the service anyway.

	== I don't want to enable MFA on my personal phone ==		== I don't want to enable MFA on my personal phone ==
	Presumably you have good reasons to reject a security enhancement for the sake of receiving a text code every so often when you're off site. It would probably be best to talk to your local IT staff about your concerns. MFA is an extremely robust security measure, and not using it will greatly increase the risk of an account compromise.		Presumably you have good reasons to reject a security enhancement for the sake of receiving a text code every so often when you're off site. It would probably be best to talk to your local IT staff about your concerns. MFA is an extremely robust security measure, and not using it will greatly increase the risk of an account compromise.

Admin at 09:26, 7 May 2020

2020-05-07T09:26:00Z

← Older revision		Revision as of 11:26, 7 May 2020
Line 1:		Line 1:
	== Multi-Factor Authentication (MFA) ==		== Multi-Factor Authentication (MFA) ==

	In 2020 Imperial will be making MFA compulsory on some sensitive services, such as ~~Office365~~, and will roll it out to other services as the need arises. Their overview and reasoning is here:		In 2020 Imperial will be making MFA compulsory on some sensitive services, such as Office 365, and will roll it out to other services as the need arises. Their overview and reasoning is here:
	'''https://www.imperial.ac.uk/admin-services/ict/self-service/be-secure/mfa/'''		'''https://www.imperial.ac.uk/admin-services/ict/self-service/be-secure/mfa/'''

Line 10:		Line 10:

	== Do I need anything special to use MFA? ==		== Do I need anything special to use MFA? ==
	The use of MFA for Office 365 does assume that you're an Office 365 user, which further assumes that you're likely to have a smartphone. ICT stats show that well over 99.9% of Imperial users ~~also~~ either use Imperial Wi-Fi on a smartphone, or read their email on a smartphone. The easiest way to get up and running is to install the app on your phone called "Microsoft Authenticator". Other authenticators are available if you prefer to support yourself.		The use of MFA for Office 365 does assume that you're an Office 365 user, which further assumes that you're likely to have a smartphone. ICT stats show that well over 99.9% of Imperial users either use Imperial Wi-Fi on a smartphone, or read their email on a smartphone. The easiest way to get up and running is to install the app on your phone called "Microsoft Authenticator". Other authenticators are available if you prefer to support yourself.

	If you only have a "dumbphone" you can still use MFA, but instead of using an app to receive your codes you get a text message. The effect is the same but it's not quite so secure if you understand how text messaging works (as an exercise for the student, read up on Signalling System No.7 vulnerabilities).		If you only have a "dumbphone" you can still use MFA, but instead of using an app to receive your codes you get a text message. The effect is the same but it's not quite so secure if you understand how text messaging works (as an exercise for the student, read up on Signalling System No.7 vulnerabilities).

Admin at 09:19, 7 May 2020

2020-05-07T09:19:28Z

← Older revision		Revision as of 11:19, 7 May 2020
Line 17:		Line 17:
	Ideally, you should reboot your PC. If you don't want to just yet, at the very least log out of your email, Skype, Teams and SharePoint. When you log in to these services again you will be prompted for your password as normal. Then, if MFA is set up correctly, you will receive a separate login code on your registered phone. Enter that, and you're all done.		Ideally, you should reboot your PC. If you don't want to just yet, at the very least log out of your email, Skype, Teams and SharePoint. When you log in to these services again you will be prompted for your password as normal. Then, if MFA is set up correctly, you will receive a separate login code on your registered phone. Enter that, and you're all done.

	== I ~~Can~~'t log in anymore after enabling MFA ==		== I can't log in anymore after enabling MFA ==
	There are a couple reasons this could happen, and they're both easy to fix.		There are a couple reasons this could happen, and they're both easy to fix.

Line 24:		Line 24:
	Once you've made your app password for your non-MFA app, you can log in with your usual account and the app password you just created (not your usual Imperial password!).		Once you've made your app password for your non-MFA app, you can log in with your usual account and the app password you just created (not your usual Imperial password!).

	The other most common reason is that your phone has poor signal. Sometimes you can try to log in and get your MFA prompt, only to find your phone doesn't get a code. This makes you try to log in again, and you still don't get a code. You try a third time and suddenly your phone gets three codes! Only enter the latest code, the previous ones are invalid.		The other most common reason is that your phone has poor signal. Sometimes you can try to log in and get your MFA prompt, only to find your phone doesn't get a code. This makes you try to log in again, and you still don't get a code. You try a third time and suddenly your phone gets three codes! Only enter the latest code, the previous ones are invalid. You probably think this is annoying, but after all if you have no signal you're not going to be able to use the service anyway.

	== I ~~Don~~'t ~~Want To Enable~~ MFA ~~On My Personal Phone~~ ==		== I don't want to enable MFA on my personal phone ==
	Presumably you have good reasons to reject a security enhancement for the sake of receiving a text code every so often when you're off site. It would probably be best to talk to your local IT staff about your concerns. MFA is an extremely robust security measure, and not using it will greatly increase the risk of an account compromise.		Presumably you have good reasons to reject a security enhancement for the sake of receiving a text code every so often when you're off site. It would probably be best to talk to your local IT staff about your concerns. MFA is an extremely robust security measure, and not using it will greatly increase the risk of an account compromise.

Admin at 09:18, 7 May 2020

2020-05-07T09:18:16Z

← Older revision		Revision as of 11:18, 7 May 2020
Line 18:		Line 18:

	== I Can't log in anymore after enabling MFA ==		== I Can't log in anymore after enabling MFA ==
	There are a couple reasons this could happen, and they're ~~all~~ easy to fix.		There are a couple reasons this could happen, and they're both easy to fix.

	The most common reason is you're using a program which doesn't support MFA. MFA functionality has only to programs still under active development, like Office and Teams. Other programs like Skype For Business and ~~Sharepoint~~, don't have the MFA features built in. They have to use a specially created "App Password". ICT have a list of programs which need app passwords, and they're very easy to create: '''https://www.imperial.ac.uk/admin-services/ict/self-service/be-secure/mfa/app-passwords/'''		The most common reason is you're using a program which doesn't support MFA. MFA functionality has only to programs still under active development, like Office and Teams. Other programs like Skype For Business, Sharepoint and most non-Microsoft email clients, don't have the MFA features built in. They have to use a specially created "App Password". ICT have a list of programs which need app passwords, and they're very easy to create: '''https://www.imperial.ac.uk/admin-services/ict/self-service/be-secure/mfa/app-passwords/'''

			Once you've made your app password for your non-MFA app, you can log in with your usual account and the app password you just created (not your usual Imperial password!).

			The other most common reason is that your phone has poor signal. Sometimes you can try to log in and get your MFA prompt, only to find your phone doesn't get a code. This makes you try to log in again, and you still don't get a code. You try a third time and suddenly your phone gets three codes! Only enter the latest code, the previous ones are invalid.

	== I Don't Want To Enable MFA On My Personal Phone ==		== I Don't Want To Enable MFA On My Personal Phone ==
	Presumably you have good reasons to reject a security enhancement for the sake of receiving a text code every so often when you're off site. It would probably be best to talk to your local IT staff about your concerns. MFA is an extremely robust security measure, and not using it will greatly increase the risk of an account compromise.		Presumably you have good reasons to reject a security enhancement for the sake of receiving a text code every so often when you're off site. It would probably be best to talk to your local IT staff about your concerns. MFA is an extremely robust security measure, and not using it will greatly increase the risk of an account compromise.

Admin at 09:14, 7 May 2020

2020-05-07T09:14:06Z

← Older revision		Revision as of 11:14, 7 May 2020
Line 6:		Line 6:
	There's no need to repeat what they say, but it is universally accepted to be a good idea to enable MFA on personal communications and collaboration services. All you need is a mobile phone.		There's no need to repeat what they say, but it is universally accepted to be a good idea to enable MFA on personal communications and collaboration services. All you need is a mobile phone.

	== How ~~To Enable~~ MFA ~~On Your Office365 Account~~ ==		== How to enable MFA on your Office 365 account ==
	First of all, ICT have to provision your account for this feature - you can't just decide to turn it on yourself. You will get an email from the "ICT Security Officer" when MFA is ready to be enabled on your account. Once it has been provisioned for you, Imperial's instructions are here: '''https://www.imperial.ac.uk/admin-services/ict/self-service/be-secure/mfa/setup-mfa/'''		First of all, ICT have to provision your account for this feature - you can't just decide to turn it on yourself. You will get an email from the "ICT Security Officer" when MFA is ready to be enabled on your account. Once it has been provisioned for you, Imperial's instructions are here: '''https://www.imperial.ac.uk/admin-services/ict/self-service/be-secure/mfa/setup-mfa/'''

	== Do I ~~Need Anything Special To Use~~ MFA? ==		== Do I need anything special to use MFA? ==
	The use of MFA for Office 365 does assume that you're an Office 365 user, which further assumes that you're likely to have a smartphone. ICT stats show that well over 99.9% of Imperial users also either use Imperial Wi-Fi on a smartphone, or read their email on a smartphone. The easiest way to get up and running is to install the app on your phone called "Microsoft Authenticator". Other authenticators are available if you prefer to support yourself.		The use of MFA for Office 365 does assume that you're an Office 365 user, which further assumes that you're likely to have a smartphone. ICT stats show that well over 99.9% of Imperial users also either use Imperial Wi-Fi on a smartphone, or read their email on a smartphone. The easiest way to get up and running is to install the app on your phone called "Microsoft Authenticator". Other authenticators are available if you prefer to support yourself.

	If you only have a "dumbphone" you can still use MFA, but instead of using an app to receive your codes you get a text message. The effect is the same but it's not quite so secure if you understand how text messaging works (as an exercise for the student, read up on Signalling System No.7 vulnerabilities).		If you only have a "dumbphone" you can still use MFA, but instead of using an app to receive your codes you get a text message. The effect is the same but it's not quite so secure if you understand how text messaging works (as an exercise for the student, read up on Signalling System No.7 vulnerabilities).

	== OK I ~~Enabled~~ MFA ~~On My Phone~~. What ~~Now~~? ==		== OK I enabled MFA on my phone. What now? ==
	Ideally, you should reboot your PC. If you don't want to just yet, at the very least log out of your email, Skype, Teams and SharePoint. When you log in to these services again you will be prompted for your password as normal. Then, if MFA is set up correctly, you will receive a separate login code on your registered phone. Enter that, and you're all done.		Ideally, you should reboot your PC. If you don't want to just yet, at the very least log out of your email, Skype, Teams and SharePoint. When you log in to these services again you will be prompted for your password as normal. Then, if MFA is set up correctly, you will receive a separate login code on your registered phone. Enter that, and you're all done.

	== I Can't ~~Log In Any More After Enabling~~ MFA ==		== I Can't log in anymore after enabling MFA ==
			There are a couple reasons this could happen, and they're all easy to fix.

			The most common reason is you're using a program which doesn't support MFA. MFA functionality has only to programs still under active development, like Office and Teams. Other programs like Skype For Business and Sharepoint, don't have the MFA features built in. They have to use a specially created "App Password". ICT have a list of programs which need app passwords, and they're very easy to create: '''https://www.imperial.ac.uk/admin-services/ict/self-service/be-secure/mfa/app-passwords/'''

	== I Don't Want To Enable MFA On My Personal Phone ==		== I Don't Want To Enable MFA On My Personal Phone ==
	Presumably you have good reasons to reject a security enhancement for the sake of receiving a text code every so often when you're off site. It would probably be best to talk to your local IT staff about your concerns. MFA is an extremely robust security measure, and not using it will greatly increase the risk of an account compromise.		Presumably you have good reasons to reject a security enhancement for the sake of receiving a text code every so often when you're off site. It would probably be best to talk to your local IT staff about your concerns. MFA is an extremely robust security measure, and not using it will greatly increase the risk of an account compromise.

Admin at 09:08, 7 May 2020

2020-05-07T09:08:28Z

← Older revision		Revision as of 11:08, 7 May 2020
Line 4:		Line 4:
	'''https://www.imperial.ac.uk/admin-services/ict/self-service/be-secure/mfa/'''		'''https://www.imperial.ac.uk/admin-services/ict/self-service/be-secure/mfa/'''

	There's no need to repeat what they say, but it is universally accepted to be a good idea to enable MFA on personal communications and collaboration services.		There's no need to repeat what they say, but it is universally accepted to be a good idea to enable MFA on personal communications and collaboration services. All you need is a mobile phone.

	== How To Enable MFA On Your Office365 Account ==		== How To Enable MFA On Your Office365 Account ==
Line 10:		Line 10:

	== Do I Need Anything Special To Use MFA? ==		== Do I Need Anything Special To Use MFA? ==
	The use of MFA for Office 365 does assume that you're an Office 365 user, which further assumes that you're likely to have a smartphone. ICT stats show that well over 99.9% of Imperial users also either use Imperial Wi-Fi on a smartphone, or read their email on a smartphone.		The use of MFA for Office 365 does assume that you're an Office 365 user, which further assumes that you're likely to have a smartphone. ICT stats show that well over 99.9% of Imperial users also either use Imperial Wi-Fi on a smartphone, or read their email on a smartphone. The easiest way to get up and running is to install the app on your phone called "Microsoft Authenticator". Other authenticators are available if you prefer to support yourself.

	If you only have a "dumbphone" you can still use MFA, but instead of using an app to receive your codes you get a text message. The effect is the same but it's not quite so secure if you understand how text messaging works (as an exercise for the student, read up on Signalling System No.7 vulnerabilities).		If you only have a "dumbphone" you can still use MFA, but instead of using an app to receive your codes you get a text message. The effect is the same but it's not quite so secure if you understand how text messaging works (as an exercise for the student, read up on Signalling System No.7 vulnerabilities).

			== OK I Enabled MFA On My Phone. What Now? ==
			Ideally, you should reboot your PC. If you don't want to just yet, at the very least log out of your email, Skype, Teams and SharePoint. When you log in to these services again you will be prompted for your password as normal. Then, if MFA is set up correctly, you will receive a separate login code on your registered phone. Enter that, and you're all done.

			== I Can't Log In Any More After Enabling MFA ==


	== I Don't Want To Enable MFA On My Personal Phone ==		== I Don't Want To Enable MFA On My Personal Phone ==
	Presumably you have good reasons to reject a security enhancement for the sake of receiving a text code every so often when you're off site. It would probably be best to talk to your local IT staff about your concerns.		Presumably you have good reasons to reject a security enhancement for the sake of receiving a text code every so often when you're off site. It would probably be best to talk to your local IT staff about your concerns. MFA is an extremely robust security measure, and not using it will greatly increase the risk of an account compromise.

Admin at 09:00, 7 May 2020

2020-05-07T09:00:33Z

← Older revision		Revision as of 11:00, 7 May 2020
Line 6:		Line 6:
	There's no need to repeat what they say, but it is universally accepted to be a good idea to enable MFA on personal communications and collaboration services.		There's no need to repeat what they say, but it is universally accepted to be a good idea to enable MFA on personal communications and collaboration services.

	== How To Enable MFA ~~on your~~ Office365 Account ==		== How To Enable MFA On Your Office365 Account ==
	First of all, ICT have to provision your account for this feature - you can't just decide to turn it on yourself. You will get an email from the "ICT Security Officer" when MFA is ready to be enabled on your account. Once it has been provisioned for you, Imperial's instructions are here: '''https://www.imperial.ac.uk/admin-services/ict/self-service/be-secure/mfa/setup-mfa/'''		First of all, ICT have to provision your account for this feature - you can't just decide to turn it on yourself. You will get an email from the "ICT Security Officer" when MFA is ready to be enabled on your account. Once it has been provisioned for you, Imperial's instructions are here: '''https://www.imperial.ac.uk/admin-services/ict/self-service/be-secure/mfa/setup-mfa/'''

			== Do I Need Anything Special To Use MFA? ==
			The use of MFA for Office 365 does assume that you're an Office 365 user, which further assumes that you're likely to have a smartphone. ICT stats show that well over 99.9% of Imperial users also either use Imperial Wi-Fi on a smartphone, or read their email on a smartphone.

			If you only have a "dumbphone" you can still use MFA, but instead of using an app to receive your codes you get a text message. The effect is the same but it's not quite so secure if you understand how text messaging works (as an exercise for the student, read up on Signalling System No.7 vulnerabilities).

			== I Don't Want To Enable MFA On My Personal Phone ==
			Presumably you have good reasons to reject a security enhancement for the sake of receiving a text code every so often when you're off site. It would probably be best to talk to your local IT staff about your concerns.

Admin: Created page with "== Multi-Factor Authentication (MFA) == In 2020 Imperial will be making MFA compulsory on some sensitive services, such as Office365, and will roll it out to other services a..."

2020-05-06T15:59:18Z

Created page with "== Multi-Factor Authentication (MFA) == In 2020 Imperial will be making MFA compulsory on some sensitive services, such as Office365, and will roll it out to other services a..."

New page

== Multi-Factor Authentication (MFA) ==

In 2020 Imperial will be making MFA compulsory on some sensitive services, such as Office365, and will roll it out to other services as the need arises. Their overview and reasoning is here:
'''https://www.imperial.ac.uk/admin-services/ict/self-service/be-secure/mfa/'''

There's no need to repeat what they say, but it is universally accepted to be a good idea to enable MFA on personal communications and collaboration services.

== How To Enable MFA on your Office365 Account ==
First of all, ICT have to provision your account for this feature - you can't just decide to turn it on yourself. You will get an email from the "ICT Security Officer" when MFA is ready to be enabled on your account. Once it has been provisioned for you, Imperial's instructions are here: '''https://www.imperial.ac.uk/admin-services/ict/self-service/be-secure/mfa/setup-mfa/'''