Environment
University of Michigan, Duo Two-Factor Authentication
Issue
Information about Multi-Factor Authentication (MFA) options other than Phone Call / SMS (text message).
Resolution
Phone Call and SMS (text message) options are not available as an MFA option for Faculty, Staff, Students, or Sponsored Affiliates.
Phone Call and SMS methods of MFA, although convenient, have notable vulnerabilities that threat actors can exploit. Phone calls and SMS can be intercepted by malicious individuals who have manipulated telecommunication providers to port a victim's phone number to a different device. This allows them to receive security codes intended for the legitimate user, thereby granting unauthorized access to sensitive systems.
Instead, ITS recommends one of the following options:
- Okta Verify mobile app with Push Notifications - Strongly recommended for ease of use and improved security
- Okta Verify mobile app with Mobile Passcodes - Recommended when traveling and/or when you do not have access to WiFi or a cellular connection.
- Okta hardware token
See Options for Passwordless and MFA for details about each of these options.
Exceptions
Faculty, Staff, Students, and Sponsored affiliates who obtain an approved exception may use Phone Call or SMS authentication options. If you are unable to use another MFA method, you can submit an exception request to be reviewed for approval to continue using Phone Call or SMS for MFA, however these will only be approved under very limited circumstances. Note that Michigan Medicine employees cannot use Phone Call or SMS for MFA under any circumstances.
Those who only have an Alumni or Retiree role and currently use Phone Call or SMS for MFA may continue to use this multi-factor authentication method at this time.
Additional Information
As the University of Michigan transitions to Okta for sign-in and multi-factor authentication, we’re here to help with any issues you may encounter. Until February 25, 2026, everyone will continue to use U-M Weblogin and Duo to access U-M Services.
Need help? Visit our Okta Help page.