User:Louis/KTH Microsoft Authenticator requirement for students

Since 1 September 2026, KTH Royal Institute of Technology in Stockholm has made multifactor authentication mandatory for all students, & a student who has not set it up cannot view the timetable, complete digital examinations or sign in to services such as Canvas, which students need for access to "the Canvas room where the exam assignment is located". KTH tells students to install Microsoft Authenticator from the App Store or Google Play & says they must have an Apple account for an iPhone or a Google account for an Android phone "to be able to install apps". KTH calls the app "the only alternative" and, explaining that choice, writes:

KTH needs to prioritise security over issues surrounding users’ ability to make alternative technology choices and/or personal IT integrity.

Microsoft's documentation for Entra ID, its identity management service, lists other methods that can be used for multifactor authentication (MFA), among them code-generating apps from other makers, & passkeys, "FIDO2-based credentials" that let a user sign in without entering a username or password & can be stored on a physical FIDO2 security key.

Requirement and services covered

KTH describes MFA as logging in "in several steps": first with the KTH account & password in a browser, then with "approval via an app on your phone". A Swedish-language notice from KTH IT-Support, published on 31 August 2026, announced that MFA would become mandatory on 1 September 2026 for everyone with an affiliation at KTH, students included.

KTH's student FAQ says MFA is needed "to access the central sign-in service", which KTH uses for signing in to Canvas, viewing the timetable & completing digital examinations, that students "need to sign in with MFA for each browser and device", & that closing the browser or staying inactive for an extended period means approving again at the next login.

The university's guide to exams in computer rooms tells students to "Bring a phone with the Microsoft Authenticator app installed to support MFA", & says invigilators are informed that students need access to a mobile phone when logging in, including if they are logged out during an exam in a computer room. A student whose phone or tablet with MFA was lost or stolen within a week before such an exam "may be eligible for extra support from KTH", after reporting the loss to the police or an insurance company & visiting KTH Entré, which KTH's setup guide invites students needing support to visit during its opening hours, with a copy of the report & valid identification no later than the day before the exam.

With Mobile BankID, students can manage their MFA settings themselves; KTH's FAQ has them log in with Mobile BankID & approve with it to remove a phone from MFA. According to BankID, a BankID lets a user identify themselves at both companies & authorities, log in to e-services and sign contracts; to get one, a person must have a Swedish personal identity number, be a customer of one of the banks that issue BankID & be identified with a valid ID document. A student without Mobile BankID who cannot sign in with MFA needs to contact IT Support for help. To add another phone, a student approves it from a phone already connected to MFA, & connecting a phone to MFA needs a computer as well as the phone.

Reasons KTH gives

The FAQ question reads "Why has KTH chosen Microsoft Authenticator as the only alternative?" on KTH's English page & "Varför har KTH valt Microsoft Authenticator som enda alternativ?" on its Swedish page. In its answer, KTH says it is "a governmental agency" that "must adapt to public procurement rules", which it says means "long and costly purchasing and implementation processes for each new service". It adds that Microsoft Authenticator "is already included in KTH’s procured and implemented services from Microsoft" & is integrated with KTH's existing identity platform.

KTH's Swedish page closes that answer with these two sentences:

KTH behöver prioritera säkerhet framför frågeställningar kring användares möjlighet till alternativa teknikval och den personliga IT-integriteten. Det innebär att KTH behöver begränsa teknikval till integrerade och resurseffektiva säkerhetslösningar.

KTH's English page gives the second sentence as:

It means that KTH needs to limit technology choices to integrated and resource efficient security solutions.

The FAQ also says KTH, its research groups & staff face digital threats "to an extent that was virtually unknown ten years ago", & that KTH "must be able to analyse usage patterns to identify malicious activity". KTH's student MFA page says that as a government agency KTH "needs to comply with security requirements" from the Swedish Civil Defence and Resilience Agency, & calls adding the app to a phone & linking it to a personal KTH account "a necessary security measure".

Installing the app

KTH's setup guide says that to install Microsoft Authenticator "you must have a compatible mobile device". It tells students to search for "Microsoft Authenticator" in the App Store or Google Play, or to scan a QR code or tap the direct links using their mobile phone. The app may ask the student to accept Microsoft's privacy policy, & KTH tells students to allow it access to notifications, the camera & location "when prompted". During setup a number appears in the computer's browser, a push notification on the phone asks the student to approve the sign-in, & the student enters the same number in the app.

Microsoft says Authenticator is available for Android & iOS, & that for MFA it "can help prevent unauthorized access to accounts" by pushing a notification to the phone or tablet, which the user approves with Verify or rejects with Deny. Number matching, typing the number shown at sign-in into the app, "is enabled for all Authenticator push notifications", & users "can't opt out of number matching".

Microsoft's page on the app carries this note about Android phones in China:

In China, the Notification through mobile app method on Android devices doesn't work because as Google play services (including push notifications) are blocked in the region. However, iOS notifications do work. For Android devices, alternate authentication methods should be made available for those users.

GrapheneOS and sandboxed Google Play

GrapheneOS is an operating system with official production support for Google Pixel devices that, like the Android Open Source Project, "doesn't include Google apps and services". It offers an optional compatibility layer, sandboxed Google Play, that runs the official releases of Google Play inside the standard app sandbox, where Google Play "receives absolutely no special access or privileges". Signing in to a Google account there is optional unless a feature depends on it, & the Play Store "requires being signed into an account in order to install apps". GrapheneOS tells users to give Google Play services a battery optimization exception "for features like push notifications to work properly in the background".

GrapheneOS's FAQ says notifications work properly on GrapheneOS & that portable apps avoiding a hard dependency on Google Play services have fully working notifications, but that apps that are not fully portable across Android implementations "often lack support for background notifications" because they only implement it through Google Play services, & that on the stock operating system such apps rely on receiving events through Google servers via Firebase Cloud Messaging.

Microsoft introduced jailbreak & root detection for work or school accounts in Authenticator, a check for what its support page calls "jailbreak or rooted modifications": if the app "detects that your device is jailbroken or rooted", all existing & new work or school accounts are blocked, & the feature "does not require IT admin configuration or control". On 5 March 2026, technology news site heise online reported that a Microsoft spokesperson told heise security, in response to an inquiry, that "Microsoft Authenticator is not officially supported on GrapheneOS" & that Entra accounts "may be impacted in the future on devices running GrapheneOS that are detected as rooted". The same report said: "It is unclear whether GrapheneOS devices will generally be recognized as rooted by Microsoft Authenticator."

Methods Entra ID supports

Microsoft's Entra ID authentication overview, last updated 7 May 2026, marks a range of methods as usable for secondary authentication with MFA, among them Microsoft Authenticator push notifications, passkeys (FIDO2), software & hardware OATH tokens, which generate one-time codes using OATH time-based one-time password (TOTP), "an open standard" (the hardware tokens listed as a preview), SMS sign-in & voice call. The same page says traditional MFA with SMS, email one-time codes or authenticator apps is "prone to remote phishing attacks", & Microsoft "recommends using phishing-resistant authentication methods" such as passkeys (FIDO2) & FIDO2 security keys.

Microsoft writes: "Third-party applications that use OATH TOTP to generate codes can also be used." In its section on hardware OATH tokens (preview), Microsoft says customers "can purchase these tokens from the vendor of their choice".

According to Microsoft's passkey guide, once an organization completes the setup steps, its users can register & sign in with a passkey stored on a FIDO2 security key, with a native or third-party passkey provider, or in Microsoft Authenticator. In a device-bound passkey, the private key is created & stored on one physical device and never leaves it. Passkeys (FIDO2) "are available in all Microsoft Entra ID editions, including Microsoft Entra ID Free", & Microsoft says "No extra licenses are required."

Other Swedish universities

Uppsala University requires MFA to sign in to student email & other Microsoft 365 services and recommends Microsoft Authenticator as the primary method. A student there who does not have a smartphone can instead use a browser extension, such as authenticator.cc, in Chrome, Firefox or Edge; the university says to use that option "as a last resort", because it "is not as secure" as the mobile app.

Luleå University of Technology (LTU) tells students who do not want to, or cannot, install Microsoft Authenticator on a phone that they can use an authenticator app on a computer, naming Google Authenticator & Bitwarden, or obtain a hardware token or YubiKey, while calling the phone app "the most convenient solution". LTU describes a hardware token or YubiKey as "a small physical device" that generates one-time codes, says students who want to use this method are responsible for obtaining one themselves, & says it only provides instructions for Microsoft Authenticator.

See also

• Forced app download
• Play Integrity API