Microsoft to discontinue SMS and voice phone call Multifactor Authentication methods

UNIVERSITY PARK, Pa. — Beginning Feb. 1, 2027, Penn State's sign-in provider, Microsoft, will no longer offer telephony methods for authentication. As a result, short message service (SMS) text messages and voice phone calls will no longer be available as Multifactor Authentication (MFA) methods. Students, faculty and staff members who currently use those methods must set up another MFA option, such as phishing-resistant passkeys — a modern, passwordless sign-in method that makes it harder for attackers to steal or reuse.

Those who do not set up another MFA method by the Feb. 1 deadline will not be able to sign in to secure Penn State resources — including but not limited to Outlook email, Workday, SIMBA, Canvas and LionPATH — until they do so.

Which MFA method should I choose?

Penn State supports several ways to securely sign in to your Penn State Account using phishing-resistant MFA. The best option for you may depend on the devices you use, whether you want your passkey to sync across devices, and how you prefer to sign in.

For more information and instructions, visit MFA: Which MFA Option Should I Choose?

Which MFA method(s) do I currently have?

You can review the MFA methods currently enrolled with your Penn State Account using the Microsoft Security page. This interface can help determine which methods you have currently enrolled, identify methods you no longer use, confirm that you have enrolled a new authentication method, and enable you to add other MFA sign-in methods. Your enrolled methods may include Passkey, Microsoft Authenticator, or Phone, depending on the authentication methods you previously enrolled.

For instructions visit, MFA: Which MFA Method(s) Do I Currently Have Enrolled for Use?

Microsoft’s ‘Let’s keep your account secure’ nudge prompt

To help with this transition, Microsoft is beginning to nudge those who use SMS text message codes or voice phone calls (to a cellphone or landline or office phone) to change to another MFA method when they sign in to a Penn State secure resource and go through the MFA process. They can either click “ ” to follow the prompt to register another MFA method or click “Not now” to postpone the process for the 24 hours. However, they will continue to receive the prompt every time they sign in until they act.

Don’t rely on a single device — Set up a backup MFA method

Penn State recommends having more than one authentication method available whenever possible. Adding more than one MFA method, such as a phishing-resistant MFA method and the Microsoft Authentication Number Matching MFA method, will help you to avoid difficulties authenticating if your primary device is lost, damaged, replaced, or unavailable, or if you need to access an application that doesn’t recognize phishing-resistant passkeys.

Adoption of phishing-resistant MFA encouraged University-wide

Although this University-wide initiative, driven by Microsoft’s enforcement requirement, primarily impacts those who use SMS or voice phone calls as their default or secondary MFA method, Penn State IT encourages the adoption of phishing-resistant methods, such as passkeys, whenever possible to better protect accounts and sensitive data from phishing attacks, credential theft and unauthorized access.

Penn State Knowledge Base resources

To learn the available MFA options, visit MFA: Which MFA Option Should I Choose?

For instructions on how to see which MFA Methods you have enrolled visit, MFA: Which MFA Method(s) Do I Currently Have Enrolled for Use?

For instructions on setting up an additional or backup MFA method, visit MFA: Add an Additional or Backup MFA Method .

For more information phishing-resistant MFA, visit MFA: What Is Phishing-Resistant MFA and How Do I Enroll?

For assistance, the IT Service Desk via chat, submit a Get Help ticket , call 814-865-4357 or email [email protected] .