Setting Up Phishing-Resistant MFA

This document will walk you through the key points you will need to know and the process you can follow to set up phishing-resistant MFA.

What is Changing?

Microsoft is eliminating two of the current methods commonly used for multi-factor authentication, SMS Text messages and telephone calls. As an alternative, Penn State is recommending the use of phishing-resistant passkeys for multi-factor authentication.

What is Not Changing?

In addition to text and telephone calls, many people currently use a two-digit number matching process with the Microsoft Authenticator App on their mobile device. This multi-factor authentication method is NOT GOING AWAY. This method is not as secure as using a phishing-resistant passkey, but is still an acceptable method and can be a good option for use as a backup method. NOTE: there are some circumstances where the Microsoft Authenticator two-digit number matching is the only MFA method that works (laptop/desktop/podium computers without bluetooth).

What is a Passkey?

A passkey is a secure way to sign in to an account using something like your fingerprint, your face, or your device's PIN instead of a password. It's more secure than a password because it can't be guessed, stolen through phishing, or reused on a fake website.

What Do I Need to Do?

If you are currently using a combination of either text message, phone call or two-digit number matching with the Microsoft Authenticator App, we are recommending that you:

  1. Set up a phishing-resistant passkey
  2. Delete the telephone or text message options
  3. Keep the two-digit number matching method.

How Do I Get Started?

The hardest part of setting up a passkey is deciding where you prefer your passkey to be stored. Depending on how you work, some locations may be easier to use than others. The options for stored passkeys include:

  • Windows Hello Passkey on a PC
  • Passkey stored in Apple Passwords on an iPhone
  • Passkey stored in Google Password Manager on an Android device
  • Passkey stored in the Microsoft Authenticator App on a mobile device
  • Passkey stored on a physical hardware security key (YubiKey)

Help Me Decide!

Generally, for PC users that only log into one or two Penn State computers on a regular basis, the easiest place to store a passkey is Windows Hello on the local computer.  Passkeys stored in Windows Hello are only available for use on that computer, so they must be set up on each computer you use.  The good news is that setting them up only takes a couple of minutes and we have instructions below.  For a more detailed list of options you can use, you can visit the MFA: Which MFA Option Should I Choose? webpage.

Show Me How!

Setting up a Windows Hello Passkey (Windows PC)

Step 1: We recommend you first watch the videos for setting up and using a passkey in Windows Hello.

 Step 2: After you have watched the videos, we suggest you follow the written instructions to set up the passkey on your own computer(s).

Setting up a Passkey on a Mobile Device

Your Windows Hello passkey is a quick and easy way to log into a PC and to complete multi-factor authentication, but it cannot be used on a mobile device.

For multi-factor authentication on a mobile device or desktop computer, we recommend that you either continue using the two-digit number matching with the Microsoft Authenticator App or you set up a passkey on your mobile device. 

Depending on what type of mobile device you use, please review the video and written instructions for setting up and using a passkey on a mobile device.

Step 1: We recommend you first watch the videos for setting up and using a passkey on a mobile device

Step 2: After you have watched the videos, we suggest you follow the written instructions to set up and use a passkey on a mobile device.

Setting up a Passkey on a Yubikey

Don't have a smartphone or mobile device to use as an authentication method? Consider the purchase and use of a physical hardware security key. Penn State has found that the YubiKey 5 Series is a popular option that is reliable and easy to set up, but any FIDO2 compatible key should work. 

Step 1: We recommend you first watch the videos for setting up a Yubikey

Step 2: After you have watched the videos, we suggest you follow the written instructions to set up and use a passkey on a mobile device.

Switching Between MFA Methods

The MFA authentication method presented to you when performing multi-factor authentication depends on the device, browser, or application you are using. If you get presented with a method you are not expecting or would like to use a different method, just look for and click the "Sign in another way" link to see other methods registered to your account.