Microsoft MFA at UCO

Multi-factor authentication (MFA) adds a step to signing in that helps confirm it is really you. In addition to your UCO username and password, you use a registered verification method, such as Microsoft Authenticator or a compatible key fob.

This extra protection helps reduce the risk of someone accessing your account with a stolen password. The Office of Information Technology (OIT) is implementing Microsoft MFA for students, faculty, and staff across campus.

No. MFA is required for account security. The optional registration period gives you time to set up your method before registration and use become required; it is not an exemption from MFA.

• Oct. 19, 2026–Feb. 1, 2027: Optional registration is available to faculty, staff, and students.
• Feb. 2, 2027: The mandatory registration campaign begins, and users who have not registered will begin seeing registration prompts when signing in. You may receive up to four registration prompts, with an option to postpone for one week at a time before registration is enforced.
• March 2, 2027: Registration and use of Microsoft MFA are required when signing in to Microsoft 365 services.
• March 23, 2027: Microsoft sign-in expands to additional UCO services, including UCONNECT, D2L, and student Gmail. Duo will no longer be an MFA option for employees in this transition.

Registration prompts are disabled until February. You can still register during the optional period by opening Security info yourself.

If you plan to use Microsoft Authenticator, have your phone or tablet available. You may install the free app in advance, but installing it before you begin is not required.

1. Open your Security info page.
2. Sign in with your UCO account and review the methods already listed.
3. Select + Add sign-in method, choose Microsoft Authenticator, and follow the setup prompts and verification test.

For screenshots and step-by-step help, follow Manage Your UCO Account Security Information.

Installing the app alone does not complete registration. You also need to connect it to your UCO account and complete the test.

Microsoft Authenticator is a free app for smartphones and tablets. Download it from the Apple App Store or Google Play using the links on Microsoft’s download page. The app connects to your UCO account so you can complete the identity-verification step.

UCO supports the following verification options:

• Microsoft Authenticator: The Apple/Android app can be used to approve sign-in requests or provide one-time codes, depending on the method you register.
• Email one-time passcode: A code sent to a personal, non-UCO email address. Use an address that is not an @uco.edu address.
• Compatible key fob: A separate authentication device available for purchase through the Central Tech Store. Microsoft-compatible devices are coming soon.

The choices available depend on the action you are completing and your account settings. A method saved for password recovery does not necessarily serve the same purpose as a sign-in method. For example, the Email option shown in Security info is described as receiving a code to reset your password.

If you want to use email instead of the app for MFA, or you are unsure which option meets your needs, contact the Service Desk before relying on it for sign-in.

Yes. A compatible key fob is an alternative for people who do not want to use a mobile device. New key fobs will be available for purchase through the Central Tech Store; Microsoft-compatible devices are coming soon. Contact the Service Desk for availability and assistance.

If you already use a UCO key fob, see the next question before making changes.

Current UCO Faculty and Staff key-fob users will receive additional instructions to exchange their device for a Microsoft-compatible version at no additional cost. Check your UCO email for details. 

Completing Microsoft MFA registration enables Microsoft Authenticator usage for select services (ie. Microsoft Office). 

During the transition, employees will still use Duo for services that have not yet switched (ie. UCONNECT, D2L, etc). Duo will no longer be an MFA option for UCO accounts starting March 23, 2027.

If you are waiting for a replacement key fob, continue using your current method until pickup and registration.

Microsoft MFA is being used for UCO services accessed through the university’s shared sign-in process, also called single sign-on (SSO). The rollout begins with Microsoft 365, with additional services—including UCONNECT, D2L, and student Gmail—following the schedule above.

Complete the verification step when a service asks for it. The screens you see may vary by service and whether you are already signed in.

If you have forgotten your password, select Forgot my password on the sign-in screen and follow the recovery instructions.

If your account is temporarily locked, wait 15 minutes and try again. If it remains locked or has been disabled, contact the UCO Service Desk for support. Contact the Service Desk if you cannot complete verification or access a registered method.

If you still have access to your previously registered device, keep it available while you set up the replacement. Add and verify your UCO account on the new device before removing the old method.

To use Authenticator’s backup and restore features, follow Microsoft’s instructions:

1. Back up your accounts in Microsoft Authenticator.
2. Restore your accounts on the new device.

For work or school accounts, restoring a backup restores the account name; you still need to sign in again and complete any required verification. Backup and restore work between the same device type, such as iPhone to iPhone or Android to Android. Backup and restore does not work cross platform (ie. Android > iPhone).

Use the account security how-to guide to add or update your method. If you no longer have access to your old device, contact the Service Desk for assistance.

Contact the Service Desk to discuss your available options.

If you have a second device registered with Microsoft Authenticator, use it to access your account and remove the lost or stolen device as soon as possible. Follow Microsoft’s instructions for removing a sign-in verification method.

If the lost or stolen device was your only registered device, contact the Service Desk immediately.

1. Check that your phone or tablet has an internet connection through Wi-Fi or cellular data.
2. Check that Microsoft Authenticator is up to date.
3. Confirm that the app is registered to your UCO account on Security info. Installing the app does not automatically connect your UCO account.

If you still cannot sign in or Microsoft Authenticator is not working, contact the Service Desk for assistance.

Microsoft Authenticator works in most locations with a stable internet connection. UCO’s current guidance identifies the following countries and regions as exceptions:

• Cuba
• North Korea
• Iran
• Sudan
• Syria
• Crimea
• Sevastopol
• Donetsk
• Luhansk

If you will be in one of these locations, or you cannot connect while traveling, contact the Service Desk for assistance. Discuss your verification options before traveling when possible.

For questions or support, reach out to the UCO Service Desk online at servicedesk.uco.edu. You can also use the Service Desk Assistance page.