OneLogin Multi-Factor Authentication

Multi-factor authentication is a method of authenticating when logging into a secure site that requires the user to present two or more means of identification. This can be something the user knows, like a password, something the user has, like a cellphone, or something the user is, like a fingerprint.

Phishing attacks have targeted and compromised a growing number of student accounts. To protect students from these attacks, we are enforcing tighter security with multi-factor authentication so that anyone who logs in must first prove their identity.

Once we have implemented the change, your default multi-factor authentication method will be enforced. If you have not configured another method, this will be the security questions you configured the first time you logged in to OneLogin. If you do not remember these, it is strongly recommended that you log in to OneLogin and review or change these before the change is implemented in January 2020. Instructions for this are here.

Please review your authentication methods and your security questions from your OneLogin Profile page. For instructions on setting up new authentication methods or reconfiguring your security questions, you can review the guides above or watch the YouTube videos we have provided above.

OneLogin allows you to use your OneLogin Security Questions, OneLogin Protect, Google Authenticator, VIP Access, or YubiKey.

You can download OneLogin Protect, Google Authenticator, and VIP Access from the Android Google Play Store or the iOS App Store for free.

YubiKeys can be found on the Yubico Store

Please see the concise MFA setup instructions located here.

Security questions require more information that you must remember and also may be relatively easy to guess. They are, like passwords, considered something you know rather than something you have or something you are. If someone with malicious intent has your username and password, they would simply need to know the answers to your security questions to gain access to your account. Security questions are better used as a fallback authentication method should you not have your phone or YubiKey.

OCIS recommends the OneLogin Protect app, OneLogin's native multi-factor authenticator app. The OneLogin Protect app is a secure and convenient option because you can easily access your account by responding to an Approve/Deny notification from the app on your mobile phone when logging in.

If this is your first time logging in to OneLogin, you will be asked to set up your multi-factor authentication method. You can choose between five options, OneLogin Security Questions, OneLogin Protect, YubiKey, Google Authenticator, and Symatec's VIP Access. If you choose OneLogin Protect, Google Authenticator, or VIP Access, you will need to install those apps onto your smartphone or tablet from the iOS AppStore or Android Google Play Store. If you choose YubiKey, you will need to have purchased a YubiKey device for authenticating and have it ready to insert into your computer, smartphone, or tablet. If you choose OneLogin Security Questions, you will be asked to configure three security questions, and two will be chosen randomly for you to answer when you log in. Regardless of your selection, if you have not previously set up security questions, you will be required to do so when logging in.