Affected End Users
End users who have one or more of the following affiliations are now required to authenticate using MFA:
- Current Students
- Current and/or Future Faculty
- Current and/or Future Staff
End users who do not have any of these affiliations are not required to authenticate using MFA unless the application explicitly requires it.
Affected Customers
The changes were made by the IAM Team (without any action needed by application owners) for:
- Enterprise Authentication
- UT Shibboleth
Application owners already integrated with the above systems who wish to implement multi-factor authentication ahead of the project go-live date were encouraged to request this change only if they can identify an urgent security need to do so.
- Canvas and Zoom switched to MFA early on May 26, 2020.
- Other applications were switched on June 15, 2020.
Frequently Asked Questions
What action did I need to take to enforce MFA on my application as part of this project?
If your application is already integrated with either Enterprise Authentication or UT Shibboleth, then no action was needed on your part.
What if my end users are prospective students/affiliates/guests/other?
They will not be prompted to authenticate using MFA unless your application explicity requires it. No action is needed on your part. Your end users should not notice any changes.
How does this impact guests using Zoom?
Guests (i.e., individuals who are not students, faculty, or staff at the university) will not be prompted to authenticate using MFA when signing on to Zoom. Guests using Zoom will not encounter any changes to their Zoom experience as a result of this project.
What if I want all of my end users to authenticate using MFA?
This project merely established a minimum security policy.
Application owners are free to configure more restrictive policies for their applications.
Application owners may not configure a less restrictive policy.
See the How do I enforce multi-factor authentication on my application? knowledge article for more information.
What if my application is using UTLogin/Austin AD/something else to authenticate?
Your application was not affected by the change on June 15, 2020.
That said, this project is being conducted in response to a change in the UT Austin Information Resources Use and Security Policy (IRUSP) and you should plan to make your application compliant in the not-too-distant future.
What if my application is hosted on UT Direct or UT Web?
This change affected your application but no action is needed on your part.
The project team has been in contact with the administrators of those systems and they are prepared to assist you, if desired.
What if this change will broke my application?
Application owners who cannot support the updated policy must request a temporary reprieve by submitting a Security Exception Request to the Information Security Office (ISO).