Search3 Results

UM System is transitioning away from voice and SMS authentication as part of Microsoft's retirement of these services and the university's broader effort to strengthen account security through phishing-resistant MFA. Voice authentication will be disabled December 1, 2026, followed by SMS authentication on July 1, 2027. Users are encouraged to adopt Microsoft Authenticator passkeys or FIDO2 security keys (YubiKeys) and register two independent authentication methods to prevent account lockouts. I

New requirement: All administrator accounts must use phishing-resistant authentication.
Deadline: October 27, 2026.
Required action: Register at least one phishing-resistant method per admin account (two if possible) and verify that it works.
Normal account: At least one phishing-resistant method is also required for the user's regular account.
Accepted methods: Passkeys (including Microsoft Authenticator and supported device-bound passkeys) and FIDO2 hardware security keys such as YubiKeys

The registration process to set up a YubiKey is the same for Windows, MacOS (using a Chrome browser) and mobile devices. However, MacOS requires that a PIN be set on the security key prior to registering the key with Microsoft.