This article explains the changes to Multi-Factor Authentication (MFA) and how its use is changing starting in Fall of 2026 and culminating in removal of SMS and phone calls on January 14, 2027.
Starting on January 14, 2027, UNC will block all SMS and voice authentication methods for Microsoft Multi-Factor Authentication (MS MFA) due to the fact that starting on February 1, 2027, Microsoft will begin removing these authentication methods for MS MFA for our tenant. That means when you are prompted after logging in with your Onyen and password to use MFA, you won’t be able to get a text message or phone call to confirm who you are. Without an alternative method, this could prevent you from accessing email and other UNC-provided services.
Instead, you will need to register a phone using MS Authenticator, a passkey or a security key as your second factor. This document explains how to set up those methods. It is best to set this up well in advance of the February 1 date so that you don’t lose access to services..
In This Article:
Setting Up MS Authenticator
The easiest and most recommended way of doing MFA is by installing the MS Authenticator application on your mobile device and responding to a “push” notification or other form of authentication such as code generation from the application whenever you sign into a Microsoft-based UNC application. This is a simple process that is explained in detail here: Modifying Existing MFA Settings
As part of the move off SMS and telephone, all users will be required to set up MS Authenticator. This will be facilitated by a registration campaign beginning in October 2026 and ending in December 2026. When you log into MS 365 or other Microsoft-protected services, you may be prompted to register MS Authenticator if you have not yet done so. The instructions above can assist with registration.
Setting Up Passkeys
If you cannot use MS Authenticator because of lack of access to a mobile device, you will need to use a passkey. There are several forms of passkey that you can choose from. LastPass is one of the options that is free to use as a university member.
LastPass
As a UNC affiliate, you can create a free LastPass premium account. With this, you can create a software passkey to use with your Onyen account. Find out more information about creating your premium account.
Once the account is created, you can register a software passkey using MS MFA. Here are more instructions on how to do that:
To authenticate to Microsoft 365 using LastPass as your FIDO2 security key / passkey provider, you bypass Microsoft Authenticator by registering LastPass as a passkey issuer directly within your Microsoft security portal. LastPass stores this passkey securely inside your vault and handles the cryptographic authentication.
Step 1: Add a New Passkey in Microsoft 365
- Open a browser and sign into your Microsoft 365 account.
- Navigate directly to your account security dashboard at aka.ms/mysecurityinfo.
- Click Add sign-in method.
- From the dropdown menu, select Passkey (security key or device) and click Add.
- Choose Face, fingerprint, PIN, or security key when asked how you want to save it.
Step 2: Use LastPass to Save the Passkey
- When Microsoft prompts your operating system to save the passkey, the LastPass browser extension will intercept the request. If it does not do this, you may have to adjust some settings on your browser to make sure LastPass is the default passkey provider and is always allowed on every website. The exact settings will depend on which browser you are using.
- A LastPass pop-up window will appear asking to save a passkey for your Microsoft 365 account.
- Confirm the save request in LastPass. You may be prompted to enter your LastPass master password or use LastPass biometrics to authorize the action.
- Give your security key a clear name on the Microsoft portal (e.g., "LastPass Vault Key") so you can identify it later.
- Click Done.
Step 3: Test Your Passkey Login
- Log out of Microsoft 365.
- Go to the sign-in page, enter your email, and select Sign in with a passkey or security key (or click Sign-in options).
- The LastPass extension will detect the request, prompt you to verify your identity, and securely pass the FIDO2 credential to Microsoft 365 without ever opening Microsoft Authenticator.
Windows Hello for Business (AD.UNC.EDU only)
For those using Windows computers that are on the AD.UNC.EDU network, you may be able to use Windows Hello as your second factor. More information on how to set up Windows Hello is located here: Windows Hello for Business
Setting Up Hardware Security Keys
Security keys are hardware devices that resemble flash drives and can be inserted into phones, tablets, laptops, and desktop computers to perform MFA. Multiple FIDO2 devices can be set up for each Onyen account, but they need to be kept secure so that they don’t get lost. These can also be set up and used in a secure location such as where access is controlled, clean rooms, and hygiene barriers, etc. Examples of these sorts of devices are YubiKeys, Google Titan Security Keys, SoloKeys, etc.
To set up a security key, follow the latest guidance from Microsoft.
You can check with your department to see if a security device can be purchased on the departmental P Card. Otherwise, they are inexpensive and can be purchased through amazon or other retailers.
Other Passkey Managers
There are many other forms of passkey available that could work for MFA. This is only a list of known ones that have been verified by Information Security Office staff. You may want to use other forms of software passkeys that you have already been using. For example, Apple Keychain, 1Password, BitWarden, and ProtonPass may all function well here.
Additional Assistance
For general questions related to MS Authenticator, passkeys, or security keys, you can contact the UNC ITS Service Desk or call 919-962-4357 (HELP).