Common questions about multi-factor authentication (MFA), the move from Duo to Microsoft, and the sign-in experience used across University of Maine System (UMS) accounts and applications.
Contents
Detailed Information
What is multi-factor authentication (MFA)?
Multi-factor authentication (MFA) adds a second proof of identity beyond your password, such as a passkey or an app notification. It protects your account even if someone learns your password. To find out whether you are required to use MFA, see Who is required to use MFA? below.
ℹ️ For more information: What is Multi-Factor Authentication (MFA)?
Who is required to use MFA?
All UMS users are eligible to enroll in Microsoft Entra MFA, but not everyone is required to right now.
- Students: If you are not already enrolled in Duo MFA, you are required to enroll in Entra MFA. Starting October 27, 2026, students enrolled in Entra MFA will receive MFA prompts when they sign in.
- Employees and some Person of Interest (POI) accounts: Faculty, staff, and student employees use Duo MFA.
UMS IT highly recommends enrolling more than one sign-in method, so you still have a way in if you lose a device.
ℹ️ For more information: Am I Eligible for Microsoft Entra Multi-Factor Authentication?, Am I Eligible for Duo Multi-Factor Authentication?, and Determining Which MFA System You Should Use (Entra or Duo)
I got an email asking me to enroll in MFA. Is it real?
Yes. UMS sends MFA enrollment reminders from help@maine.edu using Constant Contact, an email delivery service. These messages are legitimate.
If you are ever unsure about a message, do not use the links in it. Go directly to the Microsoft MFA page (accounts.maine.edu/mymfa) instead, or contact the IT Service Desk.
ℹ️ For more information: Is the “Set up Multi-Factor Authentication” email legitimate? (Entra MFA)
I already enrolled but still got a reminder email.
Reminder emails can still reach students who have already enrolled. If you have already enrolled in Entra MFA, no action is needed.
To check, go to the Microsoft MFA page (accounts.maine.edu/mymfa) and sign in. If a sign-in method other than Password or UMS MFA (external mfa) is listed, such as the Microsoft Authenticator app or a passkey, you are enrolled.
ℹ️ For more information: Am I Eligible for Microsoft Entra Multi-Factor Authentication?
Why are we moving from Duo to Microsoft Entra?
UMS is moving multi-factor authentication from Duo to Microsoft Entra. This brings your sign-ins into one consistent Microsoft experience, extends MFA protection across more accounts and applications, and adds stronger, more modern sign-in options. It also lets UMS retire older systems and make better use of tools already included in our Microsoft license.
What is different from Duo?
Duo and the new Microsoft system do the same core job: after your password, they ask you to confirm it is really you. Many of the same options you may have used with Duo, such as passkeys or an authenticator app, are available with Microsoft too.
The biggest difference is that Microsoft does more than just the verification step. It also provides single sign-on (SSO). Single sign-on means one sign-in gives you access to many connected UMS applications, so you are asked to verify far less often as you move between them. Duo handled only the verification step and did not connect your sign-ins together this way.
A few things you will notice:
What are the benefits of moving from Duo?
- Stronger protection: passkeys and security keys are phishing-resistant, meaning they cannot be tricked by a fake sign-in page.
- Fewer prompts: one sign-in works across connected applications instead of separate prompts for each.
- More choices: use a passkey, a security key, or the Microsoft Authenticator app, whichever fits your devices.
How do I move from Duo?
If you are already set up with Duo, you can keep using Duo for now. No immediate action is required.
If you would like to switch to the new Microsoft sign-in, add a sign-in method:
- Go to the Microsoft MFA page (accounts.maine.edu/mymfa) and sign in.
- Select Add sign-in method.
- Follow the setup guide for your device.
ℹ️ For more information: Get Started with Microsoft MFA (Entra), or browse all How-To Guides.
What sign-in methods can I use?
You can use any of the following:
- Microsoft Authenticator app: the recommended first step; uses a push notification you approve on your phone.
- Passkeys: Windows Hello on a UMS Windows computer, iCloud Keychain on Apple devices, Google Password Manager in Chrome, or a YubiKey security key.
Text message (SMS), phone call, and email one-time codes are not offered as MFA methods. They are not secure enough to protect your account.
ℹ️ For more information: MFA Authentication Methods
How do I set up MFA for the first time?
Go to the Microsoft MFA page (accounts.maine.edu/mymfa), sign in, and select Add sign-in method. Then follow the on-screen instructions for your selected method.
ℹ️ For more information: Get Started with Microsoft MFA (Entra), or browse all How-To Guides.
I see a message saying I am not eligible to enroll in MFA.
This message appears on the Duo MFA enrollment page. Many students who see it need to use the Microsoft MFA page (accounts.maine.edu/mymfa) instead. If you believe you need to use Duo MFA, the article below explains what to do.
ℹ️ For more information: Fixing the "You Are Not Currently Eligible to Enroll in Multi-Factor Authentication" Message
I got a new phone. What do I do?
How you move your MFA depends on the method you use. See Got a New Phone? How to Move Your MFA.
I do not have a smartphone. What are my options?
You have options that do not require a smartphone, including a YubiKey security key that plugs into your computer. If you need help choosing an option, contact the IT Service Desk.
ℹ️ For more information: MFA Without a Smartphone: Your Options (Entra MFA)
I lost my phone or I am locked out.
If you have a backup sign-in method, use it to sign in and then remove the lost device from the Microsoft MFA page (accounts.maine.edu/mymfa). If you have no backup method, contact the IT Service Desk.
ℹ️ For more information: What to Do If You Lose Your Phone or Security Key (MFA)
I am seeing an error message when I sign in.
Common sign-in errors and how to resolve them are explained in a dedicated article.
ℹ️ For more information: Common Sign-In Error Messages
Will MFA work when I travel internationally?
Yes. Passkeys and the Microsoft Authenticator app work without a cellular signal, so they work while traveling. As a precaution, set up your sign-in method before you leave.
Does this affect my personal devices?
You can save a synced passkey to your personal phone or computer for convenience. Never save a passkey to a shared or public computer, such as a lab machine, because anyone using that computer could then sign in as you.
Why do I keep getting asked to sign in again?
This is normal and depends on the device you are using.
- On a UMS-managed computer (Windows or Mac): about once every 30 days. Day-to-day sign-ins happen in the background without interruption.
- On a personal device using a web browser: each time you open a new browser session, up to once every 24 hours.
- On a personal device using apps (such as Microsoft Office and OneDrive): about once every 30 days.
If you are not asked to verify every time you sign in, that is also normal. Your sign-in stays active based on the timing above.
ℹ️ For more information: MFA Sign-In Experience: What to Expect
What if I cannot use any of the approved methods?
Several methods are designed to work with visual, hearing, motor, and cognitive accessibility needs, so start by reviewing those options. If none of them work for you, a limited exemption process is available.
Accessibility accommodations are submitted by your campus accommodation office on your behalf, not by you directly.
ℹ️ For more information: MFA Methods That Support Accessibility Needs and MFA Exemptions and Accessibility Accommodations
My question was not answered here.
If your question was not answered here, leave feedback below to let us know what is missing, or contact the IT Service Desk for help.
Environment
- Microsoft Entra
- All UMS accounts and applications that use Microsoft Entra sign-in
- Windows, macOS, iOS, Android, and web browsers