Summary
New requirement: All administrator accounts must use phishing-resistant authentication.
Deadline: October 27, 2026.
Required action: Register at least one phishing-resistant method per admin account (two if possible) and verify that it works.
Normal account: At least one phishing-resistant method is also required for the user's regular account.
Accepted methods: Passkeys (including Microsoft Authenticator and supported device-bound passkeys) and FIDO2 hardware security keys such as YubiKeys
Body
Protecting privileged access is one of the most important safeguards we have against modern cyber threats. As part of our ongoing effort to improve identity security, we are implementing a new requirement for phishing‑resistant authentication for all administrator accounts.
This requirement reflects industry best practices for protecting privileged access and will algin with Microsoft mandatory initiative that will be implemented early next year. In addition, we require you to register at least one phishing-resistant authentication method for your normal/mundane user account.
What You Need To Do
By October 27, 2026, you must complete the following for each admin account assigned to you:
- Register at least one (1) phishing‑resistant authentication methods (2 if possible)
- Verify that the registered method(s) work successfully
What Counts as Phishing‑Resistant
Phishing‑resistant authentication methods are bound to our Azure/Entra tenant and protect the user from logging into a fake login page. Examples include:
- Passkeys (such as passkeys in the Microsoft Authenticator App, or Mac Platform SSO/other device‑bound passkeys)
- FIDO2 hardware security keys (such as YubiKeys, you may ask your supervisor if they can procure one for you)
Outdated MFA methods (SMS, email codes, push notifications) do not meet this requirement.
Instructions and videos on registering and using these methods are available on the UM System MFA webpage, https://www.umsystem.edu/departments-staff/information-technology/accounts-access/multifactor-authentication.
If you have any questions or issues, please reach out to Perry Koob and Dana Campbell. Thank you for your cooperation and your role in strengthening our security posture.