CUNY Login MFA Setup

Please note the following before setting up CUNY Login MFA for the first time:

• Download Microsoft Authenticator app on your mobile phone.

  • If you do not own a mobile phone, you can set up a FIDO2 authentication factor—such as biometrics with "Windows Hello" on your computer or "FaceID" on your iPad Pro tablet, a USB security key, and in some cases, your computer or tablet itself—as an alternative.

• Complete the CUNY Login MFA setup and verification in a single session. Multiple incomplete attempts to set up your CUNY Login MFA will lock your CUNY Login MFA setup and require you to contact your help desk for assistance.

• If you don't already have Microsoft Authenticator app installed on your mobile phone, please download and install it from either the Apple App Store or Download and install the Microsoft Authenticator app on the Microsoft website for instructions.

• Make sure your mobile device is automatically synchronizing its time and date with your telephone service provider’s network.

• Although you can set up CUNY Login MFA entirely on a mobile phone, it is easier when using a web browser on a computer in addition to the mobile phone running the authenticator app. 

• Most CUNY students, faculty, and staff already have Microsoft Authenticator installed on their mobile device to access Microsoft 365 applications. Although the MFA setup procedures refer to the Microsoft Authenticator app, the same general steps still apply if you use the Google Authenticator or Oracle Mobile Authenticator app on your phone instead.

• If possible, you should configure and maintain separate CUNY Login MFA authentication factors on different devices—such as your mobile phone and tablet—to ensure continued access in case one is replaced or lost.

There are a few reasons why CUNY Login MFA may not work after you set it up:

• You did not verify your new CUNY Login MFA TOTP factor after adding it to your authentication app on your phone. You can confirm this by opening the CUNY Login Advanced Authentication – Setup Mobile Authenticator page and seeing whether the factor you were adding is listed.

  Solution:  Set up a new Authenticator app account on your phone and be sure to follow every step in Setting Up CUNY Login MFA to set up, verify, and save your CUNY Login MFA TOTP factor in a single session without interruption.

• You chose Verify Later instead of Verify Now when setting up the CUNY Login MFA TOTP factor. You can confirm this by opening the CUNY Login Advanced Authentication – Setup Mobile Authenticator page and seeing whether there is an unverified TOTP factor listed.

  Solution:  On the CUNY Login Advanced Authentication – Setup Mobile Authenticator page:

  1. Open the unverified TOTP factor’s menu ( …) and choose Verify.
  2. In the Verification Code field, type the temporary one-time password code for this factor from the authenticator app on your phone.
  3. Click Verify and Save.
     

• Your CUNY Login MFA is locked after three incomplete attempts to set it up.

  Solution: Contact your campus help desk.

• Your mobile telephone is not set to automatically synchronize its time and date with your telephone service provider’s network, so the one-time passwords do not work.

  Solution: Go to your mobile telephone settings and choose to set your device’s time and date to your telephone service provider’s network’s time and date.

Your login failed due to one of the following reasons:

• You have not set up CUNY Login MFA.

  If you have not yet set up CUNY Login MFA, please follow the instructions in Setting Up CUNY Login MFA  before logging into this application or service again.

  You must follow every step to set up, verify, and save your CUNY Login MFA and do so in a single session without interruption.

• Your CUNY Login MFA set up was incomplete.

  If you see this message after setting up CUNY Login MFA, you may have missed a step in the procedure and the CUNY Login Advanced Authentication – My Authentication Factors page has no factors or an unverified factor.

  Please open a different browser or private browser window and set up CUNY Login MFA again with a different friendly name. Be sure to follow every step in Setting Up CUNY Login MFA to set up, verify, and save your CUNY Login MFA in a single session without interruption.

• You exceeded the number of allowable MFA verification attempts using an incorrect one-time password code.

  Wait and try logging into the application or service again using the correct one-time password code.

• Your mobile authenticator is unable to communicate with CUNY Login MFA.

  Wait and try logging into the application or service again later.