Microsoft SSO and MFA

Note: The Microsoft Authenticator app is only available for mobile devices.

1. The first time you visit any SSO service, you’ll automatically see setup steps for the Microsoft Authenticator. If this isn’t your first MFA method, at mfa.luther.edu, choose “Add sign-in method” and then “Authenticator app” to get started.
2. Follow the Authenticator App setup prompts and pause when you see the QR code.
3. Download the Microsoft Authenticator app on your mobile device (iOS, Android, Windows Phone).
4. In the app, add a new “Work or school” account.
5. DON’T sign in to the phone app—instead, choose the Scan QR code setup path.
6. Lastly, the setup flow will give you a two digit code to enter into the Microsoft Authenticator.

1. The first time you visit any SSO service, exit the default setup for the Microsoft Authenticator by choosing “I want to set up a different method” on the first screen. If this isn’t your first MFA method, at mfa.luther.edu, choose “Add sign-in method”
2. Enter a phone number and choose how you’d like to be contacted.
3. If you choose “Receive a code”, you’ll receive a text with a one-time verification code. Enter the one-time verification code on the multi-factor setup page and click “Done”.
   If you choose “Call me”, you’ll receive a call and will be asked to press the “#” key.

1. Begin setup for the Microsoft Authenticator, but choose “I want to use a different authenticator app” on the first screen. 
2. Pause when you see the QR code and begin the new account setup process in your authenticator app.
3. If your authenticator app can scan QR codes, scan the new code; otherwise, click “Can’t scan” and enter the alphanumeric “Secret Key” into your authenticator. If successful, your authenticator should display a 6 digit numeric code that cycles every 30 seconds.
4. After you click next on the original MFA setup page, you’ll be prompted for the rotating code from your authenticator app. If successful, you should be taken back to the main mfa.luther.edu setup screen.

When you’re prompted for your MFA option, choose “Other ways to sign-in” at the bottom of the prompt. If you don’t see any other viable methods, call the Technology Help Desk and we can help you set one up.

Visit mfa.luther.edu.

Call the Technology Help Desk and we can give you a one-time passcode or reset your MFA settings.

If you don’t have a phone number at all, we recommend the Authenticator.cc browser extension for your computer. Set it up using the “other authenticator app” instructions above. If that still doesn’t work for you, contact the Technology Help Desk.

Many institutions use this same login process and they all go through the same portal at microsoftonline.com. This error means that you’re signed into your account at one of those other institutions and it’s causing problems. Go to mysignins.microsoft.com/security-info and in the upper right, choose “sign out” or “add account”.

You’ve chosen to use a passwordless sign-in at some point and you’re encountering a service where that isn’t valid. Go to mfa.luther.edu, remove the passwordless authentication method, and sign out (in the upper right). Sign in to your destination service again.

It’s important to know that rotating six-digit verification codes are time based, and that each code only covers a 30 second window. Our first recommendation is to wait until a new code is generated so that you have the full 30 seconds to complete the sign-in or setup process. If that still doesn’t work, make sure that the clock and time zone on both devices are exactly the same. Also make sure your clock is getting the correct time “automatically” rather than using a manual setting.