Campus-Wide MFA Implementation: Details

Background

UTS165 Standard 4.7 Two-factor Authentication Requirements details the requirements for UT System Institutions.

In response, the UT Information Security Office (ISO) updated the Information Resources Use and Security Policy (IRUSP) to include Standard 4.6 Multi-factor Authentication Requirements.

The ISO drafted the Multi-Factor Authentication Campus Strategy to explain Multi-Factor Authentication (MFA) and the policy change.

A number of high-risk web applications (e.g., W-2 claim, VPN, etc.) quickly implemented the multi-factor authentication requirements with the assistance of the ITS Identity and Access Management (IAM) Team.

In consultation with the Identity and Access Management Committee of the IT Leadership Council, it was determined that the full implementation of the campus strategy should take place after the end of the Spring 2020 semester to avoid conflicts with the university's academic mission.

On April 15, 2020 the Executive Compliance Committee approved the implementation date of June 15, 2020.

Affected End Users

End users who meet one or more of the following criteria are now required to authenticate using MFA:

  • Current Students
  • Current and Future Faculty
  • Current and Future Staff

Affected Customers

The changes made by the IAM Team (without any action needed by application owners) were for:

  • Enterprise Authentication
  • UT Shibboleth

Application owners already integrated with the above systems who wish to implement multi-factor authentication ahead of the project go-live date were encouraged to request this change only if they can identify an urgent security need to do so.

  • Canvas and Zoom switched to MFA early on May 26, 2020.
  • Other applications switched on June 15, 2020.

Exception Requests

Application owners who cannot support the updated policy must request a temporary reprieve by submitting a Security Exception Request to the ISO.

Resources

Application owners, customers, and end users may find additional information about this project on the resources tab.