Troubleshooting MFA

The MFA Authenticator app sometimes won't show notifications on your phone

when logging into the Drexel Cisco AnyConnect VPN unless...

1. you unlock your phone, 
2. open the Authenticator app, 
3. and try to look for notifications there.
4. Try any refresh icons there, 
5. and if you have multiple accounts in your Authenticator app, go into the Drexel account specifically.

If that fails...

1. Login to https://portal.office.com in a web browser (Chrome, Firefox, Safari, Edge, etc)  on your laptop or another computer or your phone.
2. If you can login to the above without using MFA, then...
3. visit https://aka.ms/mfasetup , and add a 2nd MFA method there.
4. Add a non-Drexel email or a text message. 
5. *THEN* make one of those options the default MFA option. 
6. And then try logging into the Cisco AnyConnect app.

If ALL of that fails...

1. Call 215-895-2020 Monday through Friday, 9am-5pm.
   You can try weekends if desperate, but the weekend crew is not as good
2. Then ask for help resetting MFA, 
3. Then ask for help setting 2 additional MFA methods.
4. One MFA method should be something OTHER than the Authenticator app,
   AND something OTHER than calling or texting your phone.
   That way, you aren't stuck if you lose your phone (or change your phone number or phone).

What is Multi-Factor Authentication (MFA)?

This is where you login, and then get a phone call, and press #.

• Or login, then get a text message, and get a number to enter.
• Or login, then go to an app, and get a number to enter.
• Or login, then tap “Approve” in an app notification.

Why is MFA needed?

• Passwords by themselves are not enough anymore due to phishing, social engineering, fraud, overly simple passwords, black market password lists for sale on the dark web, and more
• So a 2nd or additional way to show that you are who say you are when you login is needed.

Travel Outside the US - Use the Microsoft Authenticator MFA App & Set-up a Phone/Text MFA Method

Microsoft's Authenticator App works over internet, and it will work over WiFi in most foreign countries, unless there's some censorship blocking going on. 

BUT DOWNLOAD, INSTALL, & SET-UP IN THE APP WHILE IN THE UNITED STATES.

• Some countries (China, for example) may make installing the app from the Google Play or Apple App Store very difficult, due to its internet censorship restrictions.
• AND visit https://aka.ms/mfasetup here in the US on a couple of the devices you are bringing with you, and be sure you check the 60 days approval checkbox after login when approving MFA on each device. This is in case you need to change your MFA method.
• AND set-up a 2nd method that involves a phone call or text message. That way, if the worse case scenario happens, you can visit https://aka.ms/mfasetup , change your primary method to a phone call or text message, and have a good chance of resolving your MFA issue
• AND make a 3rd method that involves a non-Drexel email you KNOW the password for and you can access by any computer or phone.
• Be sure to see the suggested troubleshooting section below.

No Approve or Deny Notice from the Microsoft Authenticator App

1. Unlock (by fingerprint, Face ID, passcode, or PIN) your cellphone.
2. Open the Microsoft Authenticator app. Wait 5-10 seconds.
   Mobile VPN's, mobile security features, mobile power saving features, and mobile data saving features can all block background processes that allow the notification app to appear with the app being open and at the forefront of your phone.
3. Ensure you have internet connection through your mobile internet network or by WiFi.
4. If that does not work, visit https://aka.ms/mfasetup, and if you need to login and use MFA, click "try another way" or "sign in another way." 

MFA is Not Working for Me - Troubleshooting Guide

If you are using the Microsoft Authenticator app:

• If you use the app, be sure to unlock your phone and open the app and wait 10 seconds. Sometimes, especially if you use a VPN or data saver or power saver options, the app needs to be open and at the forefront of your mobile device.
• Open the app and make sure you see an entry for "Drexel University" that has your short form Drexel email address listed, and directly underneath your short form email address should be a 6-digit code that changes every 30 seconds. If you do not see that, then further set-up of the app is required.

If are using Drexel's VPN:

• Note that the VPN will say login error/failed until MFA is approved, and you only can use your primary MFA method (default authenticator).
• If you use the app, be sure to unlock your phone and open the app and wait 10 seconds. Sometimes, especially if you use a VPN or data saver or power saver options, the app needs to be open and at the forefront of your mobile device.

If you are still having issues, call 215-895-2480 or stop by the CCI Commons Lab in room 1067 on the 10th floor of 3675 Market, and ask for help.

If you already reached out to the CCI Commons Lab, and our CCI Commons Lab student assistants have already gone through the above steps, call 215-895-2020. You may have an issue with your Drexel Account.

What if the Microsoft Authenticator MFA app keeps crashing?

• Uninstall/reinstall it, but first, make sure you have a back-up method of MFA, like a phone call or text message to your cellphone, if only so that you can get your preferred Authenticator app installed.
• If you have the Authenticator app set-up on 2 or more devices, remove both MFA methods at https://aka.ms/mfasetup , but only after going to that link and setting up a back-up method of MFA, like a phone call or text message to your cellphone.
• Remember that most of the time you are prompted for MFA, there will be a sign in another way or try another way link, where you can use your 2nd or 3rd MFA method (and this is why it's important to have a 2nd or 3rd MFA method).