MFA Sign-In Experience: What to Expect

Find out when you are asked to complete multi-factor authentication (MFA), why the experience differs by device, and how the “Stay signed in?” prompt affects how long you stay signed in.

Detailed Information

This information applies to applications that use Microsoft Entra single sign-on (SSO), including applications where you complete MFA with Entra MFA or Duo MFA.

I set up MFA but I'm not being prompted when I sign in. Is something wrong?

Students: If you’re a student and you’ve set up Entra MFA, not seeing an MFA prompt when you sign in is normal. Most sites students use do not require MFA. You are still prompted when you visit a site that does require it, such as the My Security Info page. You do not need to do anything else.

Employees (including student employees): Not seeing a prompt can also be normal for you. If you’ve already completed MFA in your browser, or you sign in to your UMS-managed Windows computer with Windows Hello for Business (WHfB), that sign-in already counts as MFA. As a result, you may not see a separate prompt when you visit sites such as myCampus. See When will I be prompted for MFA? below.

When will I be prompted for MFA?

UMS does not set a scheduled MFA re-prompt. After you complete MFA, UMS does not ask you again on a set schedule. You are asked to sign in and complete MFA again only when one of the following happens:

• You change your password, including when your UMS password expires.
• You go 90 days without using your UMS account on that device or browser.
• UMS ends your sessions for security reasons, such as a suspected compromised account.
• Your browser session ends because you closed the browser and chose No at the Stay signed in? prompt (see below).
• You use an application whose owner has set its own session length. Some application owners require you to sign in or complete MFA again after a set amount of time, so those applications may prompt you more often.

UMS-managed Windows computer with Windows Hello for Business:

• MFA prompts: Rare. Signing in to or unlocking your computer with your WHfB PIN, fingerprint, or face counts as MFA.
• Day-to-day experience: Your computer has a security chip that stores your credentials securely. Your session is automatically maintained across browser restarts and reboots, and closing your browser does not require you to sign in again.

UMS-managed Windows computer without Windows Hello for Business (password sign-in):

• MFA prompts (Microsoft Edge): Once, the first time you visit a site that requires MFA. After that, only when one of the events listed above happens.
• MFA prompts (other browsers, such as Chrome or Firefox): Depends on how you answer the Stay signed in? prompt. See What does “Stay signed in?” do? below.
• Day-to-day experience: Signing in to or unlocking your computer with a password does not count as MFA, so you see an MFA prompt in your browser the first time you visit a site that requires it. After you complete it, your computer remembers that you completed MFA, and Microsoft Edge carries your session across browser restarts and reboots.

UMS-managed Mac:

• MFA prompts (web browser): Depends on how you answer the Stay signed in? prompt.
• MFA prompts (apps such as Office or OneDrive): Only when one of the events listed above happens.
• Day-to-day experience: Even though your Mac is managed by UMS, it is not joined to Entra, so your browser sign-ins work the same way they do on a personal device.

Personal device:

• MFA prompts (web browser): Depends on how you answer the Stay signed in? prompt.
• MFA prompts (apps such as Office or OneDrive): Only when one of the events listed above happens.

What does “Stay signed in?” do?

After you sign in with your UMS account, you may see a Microsoft screen that asks Stay signed in? Your answer controls whether your sign-in is remembered after you close your browser.

• Yes: Your browser remembers your sign-in after you close it. You stay signed in until your password changes, you go 90 days without using your account in that browser, UMS ends your session for security reasons, or an application’s own sign-in requirements ask you to sign in again.
• No: Your sign-in ends when you close your browser. The next time you open the browser and visit a UMS site, you sign in again, and complete MFA if the site requires it.
• Don’t show this again: Checking this box saves your answer so the screen stops appearing in that browser.

How “Stay signed in?” applies to each device:

• UMS-managed Windows computer using Microsoft Edge: Your answer has little effect. Edge uses the sign-in stored on your computer, so your session continues after you close the browser whether you choose YES or NO.
• UMS-managed Windows computer using another browser, UMS-managed Mac, or personal device: Your answer matters. Choosing YES keeps you signed in after you close the browser. Choosing NO means you sign in again each time you reopen the browser.

What does Duo’s remembered devices option do?

If you use Duo MFA, Duo can remember your device for browser-based applications so you can skip repeat MFA and passwordless sign-in requests.

You are asked for MFA again if your browser’s saved sign-in session is missing, no longer valid, or ended by UMS. This can happen if you clear your browser’s cookies or use a private or incognito window.

A typical day: what this looks like

If you are prompted for MFA when you did not expect it, and none of the events listed above apply to you, treat it as a possible security event and contact the IT Service Desk.

Why does it work this way?

The goal is to minimize unnecessary MFA prompts while keeping sessions secure. UMS-managed Windows computers have a hardware security chip that stores your credentials and maintains your session even when you close your browser. WHfB uses that chip to verify you with a PIN or biometric, which is why signing in with WHfB counts as MFA and a password sign-in does not. Mac computers, while managed by UMS, are not joined to Entra in a way that allows the same session protections, so browser sign-ins on a Mac depend on your answer to “Stay signed in?” the same way they do on a personal device.

If you use a UMS-managed Windows computer and sign in with a password, setting up Windows Hello for Business gives you the fewest MFA prompts.

Additional resources

• Windows Hello for Business
• My Security Info

Environment

• Microsoft Entra single sign-on (SSO)
• Microsoft Entra MFA
• Duo MFA
• UMS-managed Windows computers
• UMS-managed Mac computers
• Personal and unmanaged devices (browser and apps)