• When you'll be prompted to verify

  MFA may prompt you at any time to confirm it’s really you logging in:

  • The first time you login to a browser that you have not logged into before
  • The first time you access your applications from a device that you have not logged into before
  • Any time you login from a country that is different to the country of your last login
• Security benefits of MFA

  MFA helps protect accounts by adding an additional verification step to confirm the identity of users so that even if a cyber-criminal knows an individual’s password, the added layer will stop them accessing user accounts and key information such as:

  • Your name
  • Your address
  • Bank Details
  • Medical Records
  • Your work and files

Enrolling for MFA - Frequently Asked Questions

• What is the Okta Verify App?

  A lightweight and secure smartphone application

  The Okta Verify app is a lightweight application used to confirm a user’s identity on their smartphone when signing into a key University of Melbourne application. The app is developed by Okta, the University of Melbourne’s technology partner for multifactor authentication (MFA).

  Okta Verify provides an additional security step to verify your identity when you login to key University applications. This extra layer of security protects your user account from unauthorised access.

  Setting up Okta Verify

  The Okta Verify app needs to be downloaded and set up on a compatible smartphone by following a guided process. Once the setup process has completed, the Okta Verify app will display a rolling 6-digit code on your smartphone. At this point you can simply close the app. The use of this code is explained in the next section. You will also receive two emails from Okta confirming your successful enrolment.

  Two ways to verify your identity

  1. Push Notification: When prompted to verify, simply select ‘Yes, it’s me’ on your enrolled smartphone. This requires internet access.
  2. 6-digit code: Sign into a University application in the normal way and select the ‘or enter code’ option on the Okta Verify prompt screen. Now, open the Okta Verify app on your enrolled device and type the 6-digit code provided into the Okta prompt screen on your web browser, then select ‘Verify’.

  The 6-digit code is generated using the industry standard Time-Based One-Time Password Algorithm and is used to authenticate when internet access is unavailable.

  Privacy

  Okta Verify has passed all required vetting both by the App Store and the University. Okta Verify does not store any personal information – it only requires permission to use your device camera to scan a QR code to register your device with Okta.

  For more information, please read the Privacy Collection Notice.

• Where can I download the Okta Verify app?

  You can download Okta Verify to your smartphone by visiting the Google store (Android), Apple store (iPhone) and the Microsoft store (Windows).

  Once you have installed the app on your smartphone, please watch our device enrolment video guides or visit the Enrolling for MFA page to complete MFA enrolment.

• My smartphone can’t run the Okta Verify app.

  If you do not own a compatible smartphone, please contact the Service Centre (Staff) and 13MELB (Students) for assistance.

• I don’t have a smartphone.

  If you do not own a smartphone, please contact the Service Centre (Staff) and 13MELB (Students) for assistance.

• I don’t want to download the Okta Verify app on my smartphone.

  I am concerned about my privacy:

  • The Okta Verify App has passed through the App Store and University vetting processes.
  • The University has no access to the app on your phone and cannot view any of the data on your phone, other apps installed, monitor calls or track your location
  • The app requires internet for push notifications but can also operate offline via the rolling 6-digit code that updates every 30 seconds
  • The app does not require you to link it to a particular phone number

  I am concerned about using my personal smartphone:

  • The University encourages all staff and students to use their personal device to verify their identity
  • Providing a University-issued device to each user is not possible due to the high cost
  • The security provided by MFA greatly enhances the protection of not just University information but also your personal information
  • The use of MFA is a requirement for ongoing access to University services

  I am concerned about the performance impact on my smartphone:

  • The app uses minimal resources on your smartphone and prompts you only when Okta needs you to verify your current log in
• My location blocks access to the Google Play store. What should I do?

  You can manually download and install Okta Verify on your Android smartphone by following these steps:

  1. On your preferred web browser, go to sso.unimelb.edu.au and login with your University username and password.
  2. Select the Setup button for Okta Verify in the 'Setup Multifactor Authentication' area. Then select your device type.
  3. Manually download and install Okta Verify to your smartphone.
     Download link: https://uom-share.oss-cn-hangzhou.aliyuncs.com/OktaVerify-6.1.1.apk
  4. On the Setup Okta Verify screen on your web browser, select the 'Can't Scan?' option. Then, from the dropdown menu, select 'Setup manually without push notification'.
  5. Open the Okta Verify application on your Android device and select Add Account. Then select the 'No Barcode?' option at the bottom of the screen.
  6. Enter your username and the Secret Key displayed on your web browser. Then select Add Account.
  7. Select Next on your web browser, then enter the 6-digit code associated with your University account displayed on the Okta Verify application on your Android mobile device. Then select Verify.
  8. Congratulations! Your account is now registered with Okta Verify. You can now authenticate via the 6-digit codes generated on the Okta Verify application on your Android smartphone.
• Can I use Okta Verify on more than one device?

  Okta Verify app can only be enroled on one device, however The University recommends using Google Authenticator as a backup authentication factor.

  Google Authenticator can be installed on multiple devices.

• What are the minimum requirements for installing Okta Verify on my smartphone?

  Check that your smartphone meets the following requirements:

  • iOS 13.0 compatible device
  • Android version 7.0+
  • Windows Phone version 8.0+

  If you continue to have difficulties, please contact the Service Centre and 13MELB (Students) for assistance.

• When will I be prompted by Okta Verify

  You will be prompted by Okta Verify in the following scenarios:

  • The first time you login from a browser that you have not logged into before
  • The first time you access your applications from a computer that you have not logged into before
  • Any time you login from a country that is different to the country of your last login

  If you receive a notification for activity that you don’t recognise, you should contact the Service Centre (Staff) or 13MELB (Students) immediately.
• How can I authenticate using Okta Verify?
  • Push Notification –You will be required to verify your identity by accepting ‘Yes, it’s me’ prompt on your smartphone.
  • 6 digit code (Offline mode) – Alternatively, you have an option to enter the 6 digit code to verify your identity.

  If you require any further assistance, please contact the Service Centre (Staff) and 13MELB (Students).

• Do I need to keep the Okta Verify app on my smartphone, once I have enrolled for MFA?

  Yes. In order receive push notifications to confirm your identity, you need to have the app installed on your smartphone. If you have accidentally deleted the Okta Verify app, please contact the Service Centre (Staff) and 13MELB (Students).

Using MFA - Frequently Asked Questions

• What happens if I get a new smartphone?

  You can transfer multifactor authentication from your previous smartphone to a new one.

  You will need:

  • Your old smartphone
  • Your new smartphone
  • A computer

  1. On the web browser of your computer, go to sso.unimelb.edu.au, enter your login credentials and click on the 'Send Push' button.
  2. You will receive a push notification from Okta on your old smartphone. Select ‘Yes, it’s me’ on your old smartphone to verify your identity.
  3. Once logged in to your account, select the dropdown menu for your account username (located top-right), and select ‘Settings’.
  4. Under the ‘Extra Verification’ section, select the ‘Remove’ button adjacent to ‘Okta Verify’. You’ll then be asked if you want to revoke your existing Okta Verify token. Click ‘Yes’ to continue.
  5. You can now follow the steps provided in the How to Enrol for MFA guide to enrol your new smartphone.
• Can I use Google Authenticator instead?

  Yes, however we recommend that you use Okta Verify as your primary authentication factor as you will receive push notifications when verifying your identity.

  Once you have enrolled with the Okta Verify app, Google Authenticator will become available to configure as a recommended backup authentication factor.

  If you wish to use Google as a primary multifactor authenticator, please contact the Service Centre (Staff) and 13 MELB (Students) for assistance.

• What happens if I delete Okta Verify from my smartphone?

  You can use your backup factor, such as Google Authenticator, to enable you to log back in and reset Okta Verify.

  If you do not have a backup factor, please contact the Service Centre (Staff) and 13 MELB (Students) for assistance.

• How do I avoid being prompted by MFA when logging in from home?

  When logging in from a new device or from home, on the Okta Verify user login screen, tick ‘Do not challenge me on this device for the next 90 days’.

• Can I get temporary exclusion from Multifactor Authentication?

  Multifactor Authentication is required for every University of Melbourne staff member and student.

  Temporary exclusion from Multifactor Authentication can only be granted if you temporarily do not have access to your enrolled device and cannot access University applications.

  To request temporary exclusion from Multifactor Authentication, please contact the Service Centre (Staff) and 13 MELB (Students) for assistance.

• Okta push notifications and verification codes aren’t working for me?

  The most common reason for Okta push notifications and verification codes failing is a mismatch of the time and date settings on your phone and actual location. Please make sure the time and date settings on your enrolled device match those of your current location.
  
  If you are using an Android mobile device, please enable the 'Automatic date and time update' feature in your Settings.

  On your enrolled device, you can also check the following:

  • Push Notifications have been enabled in the Okta Verify app
  • Your device operating system is up to date and meets the minimum requirements  to support Okta Verify

  Please check the above and try again.

  For further assistance, please contact the Service Centre (Staff) and 13 MELB (Students) for assistance.

• How do I reset my Multifactor Authentication factor(s)?

  If you have access to your enrolled device and need to reset your Okta enrolment, please follow the steps provided in the How to Reset Your Okta Enrolment guide.

  If Okta Verify has been deleted and you are unable to reset your factor manually, please visit sso.unimelb.edu.au and authenticate via your backup factor.

  If you have trouble resetting any factor, please contact the Service Centre (Staff) and 13 MELB (Students)for assistance.

• I currently don’t have access to my enrolled factor. What should I do?

  If you do not have access to your enrolled device and cannot access University applications, please contact the Service Centre (Staff) and 13MELB (Students)for assistance.

• What if I can’t have my enrolled device with me?

  If you work or study in a restricted environment where mobile devices are not allowed, such as University physical containment rooms or science labs, please contact the Service Centre (Staff) and 13 MELB (Students) for assistance.

• I think my University account may have been compromised. What should I do?

  If you encounter suspicious activity on your University account, please immediately contact the Service Centre (Staff) and 13 MELB (Students)for assistance:

• I can’t access University mailbox on my iPhone native mail Application. What should I do?

  To access emails on your enrolled iOS 10 or lower device, please go to https://outlook.office.com/mail/inbox on your preferred mobile web browser such as Safari or Chrome or upgrade your device to a newer model that is supported by Apple

  To access emails on your enrolled iOS 11 or iOS 12 device, please delete and re-add your email account on your phone (steps provided in the Changes to Office 365 app use on Apple Devices guide) or go to https://outlook.office.com/mail/inbox on your preferred mobile web browser such as Safari or Chrome.

  For further assistance, please contact the Service Centre (Staff) and 13MELB (Students).