Multi-Factor Authentication

Many organizations worldwide use multi-factor authentication (MFA) to protect their systems and user data. MFA makes it more difficult for a threat actor to gain access to college premises and information systems, such as remote access technology, email, and billing systems, even if passwords or PINs are compromised through phishing attacks or other means. The college has adopted it as part of its ongoing efforts to ensure the safety and security of our community.

All students are required to set up MFA, regardless of their employment status with the college. To protect GBP systems and our users, we require all employees and students to use MFA when accessing designated college applications. If your devices are unable to download the app, please seek an exception by completing the exception form. If your exception request is approved, you will be granted a hardware token to use for MFA. You cannot opt out of using MFA.

MFA is setup on your phone and can be used to authenticate you whether using a personal or GBP-issued computer, tablet or phone.

MFA is an important step toward ensuring the cyber security of GBP systems and users. The Microsoft Authenticator app is solely used to authenticate your GBP account, and GBP has no access to your personal device(s) after you install the app. Please email mfa@georgebrown.ca with cyber-security-related concerns or questions.

After you have set up MFA, once a month or whenever you log in from a new location, you will be prompted to use MFA before you can access apps such as Outlook and Teams.  

NO. To protect GBP systems and our users, we require all employees and students to use MFA when accessing designated college applications. MFA is used to secure your data and accounts from malicious actors.

To learn more about cyber security best practices, please visit georgebrown.ca/its/cyber-security.

If you have a cyber-security-related question, please email us at cybersecurity@georgebrown.ca

MFA will continue to work as long as you are an active student.

Alumni accessing college services must use MFA, otherwise they cannot access their accounts.

All active students are required to setup MFA. If you are graduating and intend to use your continued access to college services, it is required that you use MFA.

Technical support is available by calling the Help Desk at 416-415-5000, ext. 4357 and selecting option 2 for the Helpdesk.

Minimum requirements for downloading the Microsoft Authenticator Application:

• Apple App Store:    
  • iPhone – iOS 14 or above    
  • iPad – iPadOS 14 or above    
  • iPod Touch – iOS 14 or above    
• Google Play Store:
  • Android Mobile Phone – Android 8 or above
  • Android Tablet – Android 8 or above

The Microsoft Authenticator app is free and available for download from the Apple App Store and Google Play Store. If your phone or tablet can access one of these stores, you should have no issues downloading the Microsoft Authenticator app. If your devices are unable to download the app, please seek an exception by completing the exception form. If your exception request is approved, you will be granted a hardware token to use for MFA. You cannot opt out of using MFA.

Select the 'I can’t see number' option on the notification so you can see the sign-in screen and the number you need to select. The prompt reappears after 3 seconds, and you can select the correct number then.

Click "Verified IDs" at the bottom right of the MS Authenticator app, then select "Scan a QR code".

The Authenticator app collects your GPS information to determine what country you are located in. The country name and location coordinates are sent back to the system to determine if you are allowed to access the protected resource. The country name is stored and reported back to the college, but your actual coordinates are never saved or stored on Microsoft servers.

Registering a device gives your device access to the college's services and doesn't allow the college to access your device.

No. You can turn off TouchID or FaceID for the Authenticator app by taking the steps listed here.

SMS and voice calls are not encrypted. This makes them easier to intercept and both are vulnerable to phishing attacks. Attackers can also trick the phone company's employees into transferring a phone number to the attacker’s SIM card, thus the SMS codes being sent to them instead of you. Authentication apps such as Microsoft Authenticator can work offline despite any outages by your phone carrier. The recent Rogers outage is one example where text messages or voice calls would not have been possible. Also, attackers usually target the weakest link in security and with MFA, SMS is the weakest link.

Please visit Microsoft's Authenticator app webpage for more information.

Once you have successfully registered for MFA, you will be prompted to authenticate when logging in to your GBP accounts once a month, or whenever you are in a new, unrecognized location. 

Faculty/Staff:

• Any Location outside of George Brown Polytechnic Campus:
  • Compliant GBP device: No challenge
  • Non-compliant GBP device: 30 days sign-in frequency
• George Brown Polytechnic Campus:
  • Compliant GBP device: No challenge
  • Non-compliant GBP device: 30 days sign-in frequency

Students:

• Any Location:
  • 30 days sign-in frequency.

As with all college policies, procedures and guidelines, employees will be expected to abide by the college’s MFA policy as part of their employment with the college. Employees who do not comply and do not have an approved exception will be subject to sanctions/discipline, which could include cancellation of contracts, being placed on an unpaid leave and/or disciplinary action up to and including termination.

MFA authentication uses a very small amount of data if data (cellular or Wi-Fi) is available. If you would prefer not to use data at all, especially when roaming or if your phone is in offline/airplane mode, you can still authenticate by clicking on “sign in another way” and using the 6-digit number provided in the Microsoft authenticator app.

Please set up MFA on your new device before resetting your old device. This can be done by following the same steps for setting up MFA by going to www.georgebrown.ca/begin and going through the setup. Once you have setup Microsoft Authenticator on the new device, you can remove the old phone from your account on the same ‘security info’ page. Now the authentication prompt will appear on your new phone.

If you have lost or a broken device, please reach out to helpdesk by calling 416-415-5000 ext. 4357. 

Please make sure that you’re installing Microsoft Authenticator on one of these supported devices:

• Apple App Store:    
  • iPhone – iOS 14 or above    
  • iPad – iPadOS 14 or above    
  • iPod Touch – iOS 14 or above    
• Google Play Store:
  • Android Mobile Phone – Android 8 or above
  • Android Tablet – Android 8 or above

If the QR code is invalid on one of the supported devices, please close the browser window and restart that step of the process as the QR code registration has to be completed within a few minutes of code generation.

Currently, MFA only applies to all Microsoft 365 services such as Outlook and Microsoft Teams, however all GBP services will require MFA.

For more information on how to back up and recover account credentials in the Authenticator app, please visit this Microsoft webpage.

Yes. MFA is essential to mitigate the risks associated with unauthorized remote access and potential breaches. MFA adds an additional layer of security, ensuring that only authorized users can access the GBP network and resources remotely.