Enrolling in Phishing Resistant MFA

This article describes the phishing resistant multi-factor authentication (PRMFA) methods available to University of Maine System (UMS) users, which methods are recommended, and which are not allowed.

Learn which phishing-resistant multi-factor authentication (PRMFA) methods are available to University of Maine System (UMS) users, which methods are recommended, and which are not allowed.

Detailed Information

PRMFA method explanations

Authentication methods define how users can verify their identity in Microsoft Entra and some highly sensitive data or roles within applications require the use of phishing-resistant MFA authentication methods. Some examples of applications that require PRMFA include IT systems, highly privileged Salesforce users, GLBA (Gramm-Leach-Bliley Act) compliant users, and applications. PRMFA methods cannot be stolen through fake sign-in pages, reused, or leaked in data breaches. When you use PRMFA, you verify your identity with biometrics (fingerprint or face recognition) or a PIN on your device. You do not need to enter your password separately. The MFA Authentication Methods article breaks down the different PRMFA methods in more detail.

There are two types of passkeys:

• Device-bound passkeys are stored on one specific device (such as your phone or a YubiKey) and cannot be copied elsewhere. They are the most secure option.
  • Enrolling in Windows Hello for Business
  • Add MFA Sign-in Method: Microsoft Authenticator Passkey
  • Add MFA Sign-in Method: Hardware Security Key (FIDO2)
  • Add MFA Sign-in Method: Windows Hello
• Syncable passkeys are backed up to a cloud account (such as iCloud or Google) and are automatically available on any device you sign in to with that account. They are very convenient and still phishing-resistant, though their security depends on the security of your personal account.
  • Add MFA Sign-in Method: Passkey in Google Password Manager (Chrome)
  • Add MFA Sign-in Method: Passkey on iPhone or iPad (iOS)
  • Add MFA Sign-in Method: Passkey on macOS (Mac, MacBook, iMac)

---

Recommendations by device and user type

Employees (faculty/staff) with UMS-managed Windows computers

Best option: Windows Hello for Business (WHfB). It's built into your managed Windows computer and uses your face, fingerprint, or PIN. Note that WHfB requires access to UMS domain controllers, so it must be set up while connected to eduroam or VPN.

If you have a secondary (e.g., aux, priv, etc.) account, you can also save its passkey to Windows Hello.

• For primary accounts: Enrolling in Windows Hello for Business
• For secondary accounts: Add MFA Sign-in Method: Windows Hello

Employees (faculty/staff) with UMS-managed Mac computers

Best option: Passwords app syncable passkey. It's stored in your Apple iCloud account and available across all your Apple devices, including iPhone, iPad, and Mac.

• Add MFA Sign-in Method: Passkey on macOS (Mac, MacBook, iMac)

Students and Employees on Personal Devices (BYOD: Bring Your Own Device)

Students and users on personal devices should set up MFA in the following order. Each step improves the experience:

1. Microsoft Authenticator app (minimum requirement): Set this up first. It is required before you can add a passkey in the app.
   • Add MFA Sign-in Method: Microsoft Authenticator App
2. Passkey in the Authenticator app (device-bound): This is the simplest passkey to set up. It's stored on your phone and does not sync to other devices.
   • Add MFA Sign-in Method: Microsoft Authenticator Passkey
3. Syncable passkey via Apple Passwords app or Google Password Manager (best day-to-day experience): It's automatically available on all your personal devices. Set this up on every personal device you use regularly.
   • Add MFA Sign-in Method: Passkey in Google Password Manager (Chrome)
   • Add MFA Sign-in Method: Passkey on iPhone or iPad (iOS)

Lab computers and shared computers

To sign in on a lab computer, use one of these approaches:

• Passkey via QR code: The sign-in screen shows a QR code. Scan it with your phone to complete authentication using the passkey on your phone. This requires Bluetooth to be enabled on the lab computer.
  • Add MFA Sign-in Method: Microsoft Authenticator Passkey

---

If you don't have the option to add a passkey

If you don't see the option to add a passkey in Entra MFA, you need UMS IT MFA Pilot Access first.

1. Request access through the UMS IT MFA Pilot Access access package.
2. In the Business justification field, enter the reason you need phishing-resistant MFA.
3. Submit the request.
4. Wait for your approval confirmation email from Microsoft.
5. Try adding your passkey again.

If you continue to have issues, contact the IT Service Desk for assistance.

Environment

• Microsoft Entra
• Windows, macOS, iOS, Android
• FIDO2-compatible browsers and devices
• Salesforce administration