Alternatives to Phone/SMS Options for Two-Factor Authentication

Environment

University of Michigan, Duo Two-Factor Authentication

Issue

Information about Multi-Factor Authentication (MFA) options other than Phone Call / SMS (text message).

Resolution

Phone Call and SMS (text message) options are not available as an MFA option for Faculty, Staff, Students, or Sponsored Affiliates. 

Phone Call and SMS methods of MFA, although convenient, have notable vulnerabilities that threat actors can exploit. Phone calls and SMS can be intercepted by malicious individuals who have manipulated telecommunication providers to port a victim's phone number to a different device. This allows them to receive security codes intended for the legitimate user, thereby granting unauthorized access to sensitive systems.

Instead, ITS recommends one of the following options:

  • Okta Verify mobile app with Push Notifications - Strongly recommended for ease of use and improved security
  • Okta Verify mobile app with Mobile Passcodes - Recommended when traveling and/or when you do not have access to WiFi or a cellular connection.
  • Okta hardware token

See Options for Passwordless and MFA for details about each of these options.

Exceptions

Faculty, Staff, Students, and Sponsored affiliates who obtain an approved exception may use Phone Call or SMS authentication options. If you are unable to use another MFA method, you can submit an exception request to be reviewed for approval to continue using Phone Call or SMS for MFA, however these will only be approved under very limited circumstances. Note that Michigan Medicine employees cannot use Phone Call or SMS for MFA under any circumstances.

Those who only have an Alumni or Retiree role and currently use Phone Call or SMS for MFA may continue to use this multi-factor authentication method at this time.

Additional Information

As the University of Michigan transitions to Okta for sign-in and multi-factor authentication, we’re here to help with any issues you may encounter. Until February 25, 2026, everyone will continue to use U-M Weblogin and Duo to access U-M Services.

Need help? Visit our Okta Help page.

Print Article

Related Articles (1)

Description of Duo notifications received when adding or removing a device from the self-service Duo Device Management.