Setting Up and Using CUNY Login MFA

Watch the following Streams video for a quick overview on setting up and using CUNY Login MFA:

Setting Up CUNY Login MFA (0:1:57)

The remainder of this document provides step-by-step instructions on setting up and using CUNY Login MFA.

The following one-time procedure provides instructions on setting up CUNY Login MFA TOTP (Time-based One-Time Password) for use with the Microsoft Authenticator mobile app when you have access to a computer as well as your phone.

1. In a new web browser window, open CUNY MFA Self-Service (https://ssologin.cuny.edu/oaa/rui).
   
   The CUNY Login page displays.
   
   
2. Enter your CUNY Login username and password, then click Log in.
   • If you are also prompted to share your location with ssologin.cuny.edu, click Allow.
   An Oracle Access Manager page is displayed with a confirmation message with the instruction to click OK to continue.
    
3. Click OK to acknowledge the message.
   
   An Oracle Identity Management page is displayed asking you to grant access to continue.
   
   

4. Click Allow to continue.
   
   The Hi, what are you managing today? page is displayed.
    

   

5. Click Manage in the My Authentication Factors tile.
   
   The CUNY Login Advanced Authentication – My Authentication Factors page is displayed.
    

   

6. Click on Add Authentication Factor to display the list of authentication factor methods.
    

   

7. Choose Mobile Authenticator – TOTP (Time-based One-Time Password).
   
   The CUNY Login Advanced Authentication - Setup Mobile Authenticator page is displayed.
    

   

8. In the Friendly Name field, type a name (such as “CUNY Login MFA”) to easily distinguish CUNY Login MFA from any other accounts in Microsoft Authenticator.
   • Do not use the exclamation point character (!) in your friendly name.
   • If you are using Microsoft Authenticator on an iPhone, use hyphens or underscores instead of spaces in the Friendly Name field. Some older iPhones may replace the spaces in the friendly name with %20 when the Friendly Name is added to the Microsoft Authenticator mobile app.  
9. Open Microsoft Authenticator on your mobile phone.
    

   

10. Tap Verified IDs at the bottom of the page or the circular button above it. The Microsoft Authenticator Verified IDs page is displayed.
     

    

11. Tap Scan a QR code.
    
    The Microsoft Authenticator Scan QR Code page is displayed.
     

    

12. Use the camera window on the Scan QR Code page to capture the QR code displayed on the CUNY Login Advanced Authentication - Setup Mobile Authenticator page on the computer.
     

    
    This sets up a new MFA account in Microsoft Authenticator having the friendly name you entered with a time-based one-time password (TOTP) code that changes every 30 seconds. A count-down timer indicates how much longer the password code remains valid for authentication.
    
    

13. On the CUNY Login Advanced Authentication - Setup Mobile Authenticator page on the computer, click Verify Now.
    
    A Verification Code field is added to the CUNY Login Advanced Authentication - Setup Mobile Authenticator page.
     

    

14. In the Verification Code field, type the password code from the Microsoft Authenticator app on the phone.
     

    

15. Click Verify and Save.
    
    The My Authentication Factors page displays showing the Mobile Authenticator - TOTP MFA account just added.
     

    

16. Click on your CUNY Login username in the top right corner of the page, choose Logout, and close your browser.

Your CUNY Login MFA TOTP method has been set up and the corresponding MFA account is now in your mobile phone’s Microsoft Authenticator app.

See “Responding to CUNY Login MFA TOTP Prompts” that follows for instructions on responding when presented with CUNY Login MFA prompts for an authentication method and one-time password.

The following procedure tells you how to enter the password code from Microsoft Authenticator when CUNY Login MFA prompts you to enter a TOTP (time-based one- time password):

1. In the CUNY Login window, enter your CUNY Login username and password, then click Log In.
   • If you are also prompted to share your location with ssologin.cuny.edu, click Allow.
     
     A window is displayed prompting you to choose your MFA login method from the displayed list of your previously established CUNY Login MFA authentication factors.
      

     

     Note:
     If you do not see a window prompting you to choose your MFA login method, your CUNY Login MFA setup may be incomplete. Clear the browser cache, close the browser window, and then follow the instructions in “Setting Up for the First Time.”
2. Click on the Enter OTP from device link corresponding to the friendly name you set up for CUNY Login MFA.
    

   

3. Open the Microsoft Authenticator app on your mobile phone to display the one-time password code.
   • Make sure to open the account you set up for use with CUNY Login MFA.
   • Consider waiting for the one-time password (OTP) code to refresh if the count- down timer gets close to zero.
      

     

4. In the Enter OTP from the registered phone field, enter the one-time password code from Microsoft Authenticator.
    

   

5. Click Verify.
   The CUNY application or service opens for your use.

Contact CCNY Service Desk for assistance

Email: servicedesk@ccny.cuny.edu
Phone: 212-650-7878
Location: NAC 1/301