Two-Factor Authentication (2FA)

What is Two-Factor Authentication (2FA)?

Two-factor authentication (2FA) is an enhanced logon process. After entering your password, you will need to confirm your access by using a designated device (e.g. your mobile).  This prevents unauthorized access to sensitive data even if your password is stolen. In HKUST, we employ an application named Microsoft Entra multifactor authentication and you may refer to web page Microsoft MFA for more information.

How it works

When access to applications supporting 2FA e.g. HKUST SSO Service

  1. Enter your email address and password
  2. Use your physical device to verify your identity e.g. your mobile phone or tablet
  3. You are securely logged in

After you have enrolled for two-factor authentication and access to applications supporting 2FA, you will need to login using your Email Address / password and then use your device to verify your identity. Microsoft MFA will issue automatic push to your mobile or you can select "I can't use my Microsoft Authenticator app right now" if applicable.

Screenshot of example web browser prompt for Authenticator app notification to complete sign-in process.

[Under circumstances when you cannot access your mobile device, you can also obtain a one-time TAP Code (not the one-time passcode) to access a 2FA application.]

Getting Started

Application Readiness (enabled with 2FA)

For Student For Staff

1. Remote Access Tools

2. Teaching and Learning Resources

3. Research IT Resources

  • High Performance Computing Clusters (for DUO enrolled user only)

4. Administrative Systems

  • Peoplesoft
  • Administrative websites (Student)

5. Collaboration and Productivity Tools

1. Remote Access Tools

2. Teaching and Learning Resources

3. Research IT Resources

  • High Performance Computing Clusters (for DUO enrolled user only)

4. Administrative Systems

  • Peoplesoft
  • Administrative websites (Staff)

5. Collaboration and Productivity Tools

When accessing the above 2FA supported applications, please remember to have your mobile device around to respond the Microsoft Authenticator - notification sent to your mobile device. In case there is no network connection, you can use one-time passcode (obtain from your Microsoft Authenticator App).

Log in to the Microsoft MFA Enrollment Portal for first-time MFA enablement.

  MFA Enrollment Portal  

After MFA enablement, please visit the Microsoft MFA Self-Service Portal to manage your MFA device.

Refer to Enrollment for 2FA (or view video) for the details.

  MFA Self-Service Portal  

Please response to the Push Notification using your mobile device when you need to access applications supporting 2FA e.g. VPN, OWA etc. Besides, you can use Temporary Access Pass (TAP) in case you cannot receive the Push due to network connection issues.

You can obtain a TAP Code in case you cannot access to your mobile device (e.g. no battery, lost / change mobile):

  TAP Code  

For DUO MFA Users only
Log on to the DUO Self-Service Portal if would like to activate / manage your account. See Enrollment for 2FA (or view video) for the details.
 

  Duo Self-Service Portal  

Please response to the Push Notification using your mobile device when you need to access applications supporting 2FA e.g. VPN, OWA etc. Besides, you can use one-time passcode in case you cannot receive the Push due to network connection issues.

You can obtain a DUO Bypass Code in case you cannot access to your mobile device (e.g. no battery, lost / change mobile):

  Duo Bypass Code  

  Lost / Change Mobile  

What's New
FAQs
Related Tools