Multi-Factor Authentication for Office 365

Multi-Factor Authentication (MFA) helps secure user sign-ins for cloud services beyond just a single password. With MFA for Office 365, users are required to acknowledge a phone call, text message, or app notification on their smart phones after correctly entering their passwords. They can sign in only after this second authentication factor has been satisfied. MFA is currently an optional service for the HUIT O365 community.

These instructions will show you how to access an MFA code for Office 365 applications on your desktop using the Office 365 Outlook Web Application (OWA).

1. To access settings for multi-factor authentication for O365, first log into OWA at will receive a text message or a Microsoft Authenticator application verification request to your pre-determined device. Enter the verification code at the security screen or verify the request if using the authenticator application on your mobile device.

Harvard Login Screen

2. Once in the mailbox, click the action gear at the top right, and at the bottom under My app settings, select Office 365.

MFA Settings

3. Select Security & Privacy and click on Additional security verification. This will drop down to an additional link. Select Update your phone numbers used for account security

MFA Security and Privacy Setttings

4. Next to Additional security verification, click app passwords.

Click App Passwords

5. Once in app passwords, you will see the blue create button. Click this to generate a new, 16-digit alpha app password.

Click Create

6. Name the app password according to the application/device. It is advisable to create a separate app password per each device.

Name App Password

7. Copy the app password and use in lieu of your HarvardKey password for email setup in Outlook (desktop and mobile devices). Note: clicking “copy password to clipboard” will not copy it, it will only highlight it. You will still need to ctrl-C (or command-C). Once you select “close” the password will disappear forever. However, an app password can be deleted and recreated from the same console if it was not copied correctly.

Copy app password