MFA - Frequently Asked Questions

Manage MFA settings as a guest user

If you need to change the authentication methods or wish to set authentication methods in advance, do the following:

• Log in with your account ID at https://myaccount.microsoft.com/
• At the top right of the portal, select the icon Organizations, which opens a list of all organizations you have been invited to as a guest.
• Select University of Oulu (Oulun yliopisto) under Other organizations you belong to.
• Then, select Security info from the left side menu.
• Now you can see the identification methods registered for the guest organization and you can update them or you can add a new one from +Add method.
• You can return to the view of your own organization by selecting first Overview from the left side and then your organization from the Organizations menu from the top right (or selecting your private account if you have been invited to be a user by some other than an organization ID).

How to leave the organization

• If you no longer collaborate with the University of Oulu, you can leave the organization if you wish. In the Organizations menu, select Manage organizations and select Leave organization under the University of Oulu. After that, you will no longer have access to O365 environments or files that have been shared with you.

Do I need to use MFA when I use Office 365 apps on mobile?

Yes. MFA is also required in mobile applications and is required from outside the university network when logging in or if there is no VPN connection.

Can I opt out of using MFA?

Multi-factor authetication (MFA) has been enabled for all University of Oulu user account and it automatically applies to all persons using student, staff or UFO account when using services or systems that require Microsoft's O365 login.

What methods of identification can I use with MFA, and do I necessarily need a smartphone?

• Using MFA is easiest with an app installed on your smartphone, but there are other options.
• You can also receive the verification code used for logging in as a text message or via a call made by the robot.

What if I have both a staff account and a student account?

• These are separate accounts with separate settings.
•  The MFA may be in use with either on one account or on both. N.B. MFA will become mandatory for all university O365 accounts during 2021.
•  You must specify own MFA authentication settings for both accounts.
•  Each account can use Authenticator app and it has to be connected separately for both acoounts. The app shows both accounts (account@student.oulu.fi and account@univ.yo.oulu.fi) separately.
•  You can also set the same phone number for both accounts if you want to use SMS or phone call for authentication.
•  If you enable an MFA yourself, the deployment form has a separate setting for staff and student accounts.

Does the use of MFA expand to other login methods?

The plan is to expand the use in the future, possibly for logging into a workstation and for HAKA login

More information required

• If you have not chosen and set up the verification method in your MS account security information, you will receive a notification “More information required” at the login stage and you will be directed to set your authentication method without delay. Follow the instructions on the screen and set the phone as your verification method.

Why is additional identification asked several times?

• Different systems/applications may ask individually for login on the first time after MFA's introduction.
• To reduce requests, select Yes to “Stay signed in?” at login or select a 60-day break for that device.

When I try to log into university services, I'm suggested to use another O365 account. What do I do?

• Use another browser or open the so-called private browser window and log into the service in that window with your university account.
• The Private browsing window can be opened at the top right corner of the browser from behind three points/dash.
• Different browsers use different terms from the private browsing window: Firefox - Private, Chrome - Incognito, or Edge - InPrivate.
• The problem can also be helped by clearing the browser cache, and you may also need to delete browser cookies and history.

Login to your  Microsoft account's security info

• Notice, that after MFA is deployed, verification (MFA) is required when you sign in to your Microsoft account security info, even on university network or when using VPN.

Authenticator does not send notification of login request

• The notification may not appear if the phone is locked. If necessary, unlock the phone.
• You can try another method of verification by selecting “Log in another way”.
• Remove the authenticator app from the authentication methods and add it again at https://mysignins.microsoft.com/security-info.

Can authenticator app be on multiple devices or phones?

• Yes, you can install the application on multiple devices.
• You need to add the device or phone as one of the verification methods at https://mysignins.microsoft.com/security-info.

Unable to deploy the authenticator app

• When installing the application, you must allow access to the camera. If you first chose not to allow camera access, uninstall the app and reinstall it, and allow camera access when asked.
• Log out or delete the account and add again.

Unable to read QR code on phone or app

You can manually connect your account and verification if you can't read the QR code in the app.

•  Do as in the instructed on the document "MFA’s verification method setting" until the QR code is asked
•  Click on the link below the QR code displayed on the computer: "Can't scan image?".
•  The page shows  a code and URL that you should add to the Microsoft Authenticator app.
•  Continue as in the instructed on the guide MFA’s verification method setting.

Authenticator app asks for some code

• Application may have an app lock setting on. Before you can accept additional verification, you need to enter your phone's own access code (PIN) before you can accept the login in the app itself.
• You can change the setting on the Authenticator app: Open the Authenticator app > Click the hamburger menu on the top > select “Settings” > turn off “App lock”.

What do I have to do when I get a phone call?

• If you select a telephone call for additional verification, you will receive a verification telephone call.
• When Microsoft's robot calls and provides additional instructions, you accept the login by pressing the “pund" key (#).
• If you don't have time to do the verification in time, you can order it again in the login window.
• If you don't notice the call entry, check the phone's settings to ensure that notifications of incoming calls come on the screen and, moreover, as an audible signal that you don't miss them.
• Some models (Samsung) have blocked certain types of (mechanized) text messages and calls: check the settings if you do not receive a call.
• You can use a phone call as a verification method if you don't have a smartphone or you don't want to use the free mobile app. The phone you use for authentication can be university work phone or yours, as long as you usually have it with you.
• The call service does not incur any expenses for you and the phone does not have to have a data connection.

How can I change verification method if I have already installed an app?

1. Using the browser of a computer, sign in to https://mysignins.microsoft.com/security-info. 
2. On the Security Info page, click the + Add a method button.
3. From the pull-down menu, select Phone and click Add.
4. Select a country code and enter your phone number in the format you have received from the operator
5. Select whether you want the receive verification as a text message or a call. Click Next.
6. The service sends the test verification to the phone you have just chosen; as a message or a call (it may take several minutes to arrive). If the verification comes as a text message, enter the six-digit code you received in the window displayed on the computer and click Next. If you chose the call, answer the  call from Microsoft robot and press the pound key (#) on the phone.
7.  In the browser, click Done.
8. Last, change the Default sign-in method from the text section above the methods box: Default sign-in method: Microsoft Authenticator - notification Change.

For more detailed instructions:

• Instructions for staff on Patio (see in the attachment MFA’s verification method setting, under section B. Set Phone as your method).
• Instructions for students

How can I log in if I can't use my phone?

• MFA is only required when you log in to services from outside the university network or without a VPN connection. MFA is however usually required every time you sign in to your Microsoft account to change the security information.
• We recommend that you set a secondary method of verification on a different phone/device than you primarily use is, if possible. Then you can do the verification using the secondary method and device.
• If this not possible contact Campus ICT support service.

I have a new phone and I can't use my old phone to verify login

• When you take MFA into use, it is recommended to set a verification method as SMS or telephone call to a different phone/device, if possible. In this case, when the phone changes, you can change the method of identification using a secondary method of identification.
• If the secondary verification is not specified or is connected to your old phone, please contact Campus ICT support service.

What do I have to do if my phone changes?

•  First, enable MFA on your new phone, according to the guide Set MFA's verification method
•  Only after that, remove the old phone from the security info of your Microsoft account with the delete button.
•  If there is a malfunction in the service, please contact Campus ICT support service. The MFA can be turned off temporarily.

My phone broke down, what can I do?

• If the phone broke down, the use of O365 services is not immediately prevented because the MFA does not ask verification continuously.
• As a precaution, it is recommended to set SMS or dial-up as the other method of verification, and preferably to a different phone/device if possible. In this case, if the phone broke down, you can change the method of identification by using the secondary method of verification or transfer the SIM card to another phone with the possibility of receiving SMS messages for verification.
• However, if you can't use secondary verification contact Campus ICT support service.

Outlook constantly asks for login on your mobile device

•  Install Microsoft Authenticator app on the same device

My mobile device email no longer works after MFA's introduction

• Install Outlook for Android or Outlook for iOS and add to your work or student email account.
• Also, install the Microsoft Authenticator app on the same device.

My mobile device calendar no longer updates after MFA deployment

• Download Outlook for Android or Outlook for iOS from the app store on your mobile device.

Some Android phones have had some problems after the introduction of MFA. Problems occur randomly and do not appear to be related to specific phone models or users. The problems that can occur are:  the phone requires login to the O365 service, the synchronization of emails and calendar does not work or one can't use Teams.