Migrating from DUO to Microsoft MFA authentication for all Purdue campuses

A: Duo will be retired and replaced with Microsoft MFA in January 2026.

A: The Duo Mobile application will no longer be required to access Purdue IT services.  You may uninstall the application from your device if you do not need it for personal use. 

A: The login screen for Purdue University applications will change.  

You will authenticate with your username@purdue.edu and password when logging into university applications.  If you are already enrolled with Microsoft MFA, you will be prompted to complete authentication with your enrolled Microsoft MFA method.     

If you are not enrolled with Microsoft MFA, you will be prompted to set up MFA. This will happen automatically.  

Applications that require Microsoft MFA include any application supported by Purdue Single Sign-On (SuccessFactors, Brightspace, MyPurdue, GoPFW, etc.), the VPN, and Microsoft applications including Outlook and O365 applications.  

A: No, hardware tokens previously provided by the university are not compatible with Microsoft MFA.  If you do not own a smart phone or are unable to use Microsoft Authenticator, a physical token may be utilized. Learn more by reading "How do I obtain a physical token (FOB) for MFA?" in the Purdue IT Knowledge Base.  

A: Current Applications that are protected by MFA: 

• Outlook (University email) 

• Teams 

• OneDrive 

• Office 365 applications 

After this change, additional applications that will be protected by MFA: 

• Applications protected by Purdue Single-Sign On (SuccessFactors, Brightspace, MyPurdue, etc.) 

• VPN 

A: Before getting a new phone, follow the instructions from Microsoft to back up your Authenticator App: Back up account credentials in Microsoft Authenticator.

If you did not back up your account credentials, you may still be able to access  your Microsoft email and applications by following the instructions here: Lost access to your Microsoft Authenticator? How to reconnect to Microsoft MFA.

To have your Microsoft Authenticator App reset, you must contact the Purdue IT Service Desk by calling 765-494-4000 or visit a service desk location.

For information on how to set up Microsoft MFA, see How to set up Microsoft multi-factor authentication (MFA).

A: Microsoft multi-factor authentication allows users to verify authentication using three methods: the Microsoft Authenticator App (default method), SMS text messaging, or an audio phone call.

Users without a smartphone should follow the instructions in the video above, but instead of selecting "Authenticator App" they should select "phone." Users will then be prompted to choose if they want to receive an authentication code via text message or a phone call. Follow the prompts provided by Microsoft to complete the enrollment processes. 

 If you do not own a smartphone, or plan to be in a part of the world where you will not have Internet access and are therefore unable to use Microsoft Authenticator, a physical token may be utilized. To learn more, see "How do I obtain a physical token (FOB) for MFA?" in the Purdue iT knowledge base. 

A: MFA works on iPhone and Mac devices without issue if the device is up to date. If you are experiencing issues accessing your email on these devices, while using the included mail application, this means you either need to update the device, or re-add your mail account to the application. At this time, the only mail client we support fully is Outlook. However, we have had no issues with current mail clients provided by Apple, as they support modern authentication.

A: Microsoft Authenticator app (Default Method)

• Microsoft authenticator is the preferred solution for approving MFA requests. It provides simple push notifications so the user does not have to enter codes into the authentication dialogue, and can generate 6 digit codes if needed.

SMS Codes (Text messages)

• Users can receive text messages/SMS containing codes they can enter to approve the authentication.
   
  • This method is only recommend as a back-up if the Authenticator App is not available. To receive text messages for authentication you must first set up your account to include text messaging as a verification method. To do this see: Microsoft Support's: Set up text messaging as your verification method

Phone Calls

• Users can register a cell or landline phone number to receive a call that prompts them to approve the authentication. 
   
  • This method is only recommend as a back-up if the Authenticator App is not available. To receive text messages for authentication you must first set up your account to include text messaging as a verification method. To do this see: Microsoft Support's: Set up a phone call as your verification method

Physical token (FOB) for MFA

• If you do not own a smartphone, or plan to be in a part of the world where you will not have Internet access and are therefore unable to use Microsoft Authenticator, a physical token may be utilized. Learn more by reading "How do I obtain a physical token (FOB) for MFA?" in the Purdue iT Knowledge Base. 

A: Microsoft and Purdue IT highly recommend using the Outlook Web App (OWA), Outlook email client, or the Outlook mobile app to access your Purdue Office 365 email.

Depending on your phone and/or email client, Microsoft MFA may not work with unsupported desktop and third-party email applications and are not recommended. Changes to Microsoft MFA and security policies may affect the ability to use these clients after enrollment.

In some cases, already established mail profiles can't make the transition to MFA from single factor authentication and users should remove the profile from their mail client on their phone, then re-add it to enable MFA security.

For the best experience and complete support, Microsoft recommends connecting through one of the following ways:

• connecting to the Outlook Web App (OWA) using a web browser and the link below:
  • https://outlook.office.com
• via Exchange within the most current version of the Outlook desktop client or using the most current version of Outlook App for iOS/Android

Microsoft's mobile Outlook App is a proven option that works with MFA; you can learn more by visiting the link below:

• https://www.microsoft.com/en-us/microsoft-365/outlook-mobile-for-android-and-ios

Microsoft DOES NOT recommend the use of other clients with Office 365, as there are often significant limitations in client functionality as a result.

Because of this, Purdue IT is only able to offer best-effort support for non-Microsoft supported clients, and certain issues may require the use of a Microsoft client to be resolved.

To find help with other clients, please visit:

• Microsoft Support
• Google Support
• Apple Mail Support
• Thunderbird Support

A: Microsoft MFA provides multiple options for authenticating your log in credentials, including the Microsoft Authenticator App, voice calls and text messages to your cell phone, voice calls to a landline office phone, and the use of physical hardware tokens (also called FOBs). It is recommended that users have at least two authentication options registered.  

Go to How to change Microsoft MFA authentication methods

A: Multi-factor authentication means that anyone logging into your email account must know both the password and have something with them – like a cell phone or access to your landline telephone number.  

If your account becomes compromised – say because of phishing or someone stealing your password – they still won’t be able to access your account because they are unable to provide the second required authentication factor.  

To learn more, visit this page from Microsoft which explains more fully how MFA works.