Body
In certain circumstances, users may be eligible for an MFA exemption or accommodation. This article explains what types of exemptions are available and how the process works.
Detailed Information
Can I Be Exempted from MFA?
MFA is required for all UMS users. However, limited exemptions may be granted in specific circumstances. All exemptions must be approved by the Information Security Office, and most are temporary.
Types of Exemptions
Accessibility Accommodations
MFA exemptions may be granted for users who cannot complete standard MFA challenges due to a disability or other accessibility need.
Requirements for an accessibility exemption:
- The specific barrier must already be documented as a recorded accommodation, made on a case-by-case basis. Employees and guests record accommodations with the ADA Coordinator in the Office of Equal Opportunity and Title IX Services. Student accommodations are made through the Student Services offices.
- Submitting the request triggers an automated workflow: the accommodation office confirms the accommodation is on file, then the Information Security Office reviews and approves the exemption. You do not need to submit separate documentation for the MFA exemption.
- An assessment of compensating controls, additional safeguards used in place of standard MFA, must be included. Examples include requiring sign-in from a specific trusted device, limiting network access, or increasing monitoring of the account.
- All accessibility exemptions are reviewed annually and revoked when no longer necessary or when accessible alternatives become available.
ℹ️ INFO: If you find push notifications too fast due to a disability, alternative MFA methods may help. FIDO2 security keys (YubiKeys) and Windows Hello provide an authentication experience that does not rely on entering a time-limited code or responding to a push notification within a short window.
ℹ️ INFO: If a user misses the MFA prompt window, they are not locked out of their account. They can restart the sign-in process without losing their primary login state (username/password).
Lab Computers, Instructor Stations, and Technical Equipment
Devices such as computer lab machines, instructor stations, or single-purpose research equipment may have physical limitations that prevent standard MFA methods, such as no Bluetooth LE or USB access for security keys. These devices will be evaluated on a case-by-case basis by the Information Security Office for compensating controls.
Other Exemptions
Any other exemptions from MFA will be temporary and must be approved by the Information Security Office.
How to Request an Exemption
If you do not already have a disability-related accommodation on file, request one first. Employees and guests should contact the ADA Coordinator; students should contact their Student Services office. Visit UMS Disability & Accessibility Services to start a request or find your campus contact. For more on how the accommodation process works, see the UMS Procedure for Accommodating Individuals with Disabilities.
Submit an MFA Exemption Request form. Your request will first be routed to the appropriate accommodation office to confirm your accommodation is on file, then to the Information Security Office for approval. Be prepared to identify the specific barrier and any alternatives that have been considered.
Environment
- Microsoft Entra ID (Azure AD)
- All UMS applications using Entra SSO