Multi-factor authentication (MFA)

Multi-factor authentication (MFA) is an essential security control, adding a critical barrier that helps block unauthorised access even when passwords are compromised.

It typically requires a combination of something you know (pin, secret question), something you have (card, token) or something you are (fingerprint or other biometric).

At ANU we use MFA to authenticate single sign-ons (SSOs) into University systems and software such as Microsoft 365 or your email.

The Microsoft Authenticator application is the preferred tool.

The University doesn't provide service support for other authenticator applications. If you wish to use a Time-based One-Time Password (TOTP) client for multifactor authentication, you are responsible for troubleshooting any problems.

Set up the Microsoft Authenticator app

You will need your phone and your laptop (or desktop) to set up the application.

Download the application from Goole Play store (Android phones) or Apple App store (Apple phone).

  1. Using either a laptop or a desktop, go on the Microsoft My Work Account website.
  2. Enter your University ID (UID) email address (e.g., u1234567@anu.edu.au) and your password.
  3. Then click 'Next'.
  4. You will be prompted for ‘More information required’, click ‘Next’.
  5. On the ‘Keep your Account Secure’ page, click ‘Next’.
  6. On the ‘Set up Your Account page’ click on ‘Next’.
  7. Continue to ‘Add your device’ in the collapsible section below. 

  1. Using either a laptop or desktop, go to the Microsoft Sign In website.
  2. Click ‘Add sign-in method’.
  3. Select ‘Microsoft Authenticator’ and then click ‘Next’.
  4. On the ‘Set up your account’ window, click ‘Next’.
  5. On your phone, open the Microsoft Authenticator app.
  6. Click on the plus icon (+) to add a new account.
  7. Select ‘Work or School Account’.
  8. Select ‘Scan a QR code’. You may be prompted to ‘Allow access to camera’.
  9. With your phone, scan the QR code which has appeared on the laptop or desktop.
  10. Click ‘Next’.
  11. You will receive a push notification from the Microsoft Authenticator. Please note: If you didn't receive the prompt, make sure you have push notifications enabled.
  12. Follow the prompts to authenticate.
  13. You will receive a confirmation on your computer. Click 'Next'.

The Multi-factor Authentication is now set up for your ANU account. You can now close the page and the application.

What to do if you...

If you are existing staff or a student and you got a new phone, please set up the MFA before wiping your old phone. If you don't have access to your old phone, please contact the ANU Service Desk. 

  1. Download the Microsoft Authenticator on your NEW phone.
  2. Using either a laptop or desktop, go to the Microsoft Sign In website. If prompted, enter the University ID (UID) email address (e.g., u1234567@anu.edu.au) and your password.
  3. Authenticate access using your OLD phone.
  4. Click ‘Add sign-in method’.
  5. Select ‘Microsoft Authenticator’ and then click ‘Next’.
  6. On the ‘Set up your account’ window, click ‘Next’.
  7. On your NEW phone, open the Microsoft Authenticator app.
  8. Click on the plus icon (+) to add a new account.
  9. Select ‘Work or School Account’.
  10. Select ‘Scan a QR code’. You may be prompted to ‘Allow access to camera’.
  11. With your NEW phone, scan the QR code which has appeared on the laptop or desktop.
  12. Click ‘Next’.
  13. You will receive a push notification from the Microsoft Authenticator. Please note: If you didn't receive the prompt, make sure you have push notifications enabled.
  14. Follow the prompts to authenticate.
  15. You will receive a confirmation on your computer. Click Next.

You can now close the page and the application.

If you have the Microsoft Authenticator already installed, you will just need to add the ANU account. Follow the steps below:

  1. Using either a laptop or desktop, go to the Microsoft Sign In website.
  2. If prompted, enter the University ID (UID) email address (e.g., u1234567@anu.edu.au) and your password.
  3. Click ‘Add sign-in method’.
  4. Select ‘Microsoft Authenticator’ and then click ‘Next’.
  5. On the ‘Set up your account’ window, click ‘Next’.
  6. On your phone, open the Microsoft Authenticator app.
  7. Click on the plus icon (+) to add a new account.
  8. Select ‘Work or School Account’.
  9. Select ‘Scan a QR code’. You may be prompted to ‘Allow access to camera’.
  10. With your phone, scan the QR code which has appeared on the laptop or desktop.
  11. Click ‘Next’.
  12. You will receive a push notification from the Microsoft Authenticator. Please note: If you didn't receive the prompt, make sure you have push notifications enabled.
  13. Follow the prompts to authenticate.
  14. You will receive a confirmation on your computer. Click Next.

The Multi-factor Authentication is now set up for your ANU account. You can now close the page and the application.

There may be various reasons why you can’t use the Microsoft Authenticator app. 

You can use the Time-based One-Time Password (TOTP) client. Please note the University doesn’t provide support for TOTP. You will be responsible for troubleshooting any problems.

You may also wish to apply for MFA exemption. Exemptions are allowed only in circumstances where you have one or more barriers that prevent you from using the ANU MFA authenticator application. Exemptions may be granted due to disability, injury or illness, or another reason such as the inability to access mobile devices in a secure lab environment.

If you are a staff or student, please read more on the exemption criteria. 

If you are an alumni, please email communications.iso@anu.edu.au with your name, a contact number, and a high-level overview of why you require an exemption. Please do not provide any medical information or supporting documentation in your initial email. 

MFA for personal accounts

For your personal accounts such as Gmail, Apple, Yahoo, LinkedIn, etc. the Australian Cyber Security Centre (ACSC) has developed guidance on how to implement multifactor authentication for the most common online services. If a service you use is not listed, then refer to the support website for your service provider.

Report a cyber incident

We will never ask you to verify your account by clicking a link in an email. Please treat any such requests with suspicion and report them as soon as possible.

Report a cyber incident. 

 

Policies

Related links

Contact