• When you'll be prompted to verify

  MFA may prompt you at any time to confirm it’s really you logging in:

  • The first time you login to a browser that you have not logged into before
  • The first time you access your applications from a device that you have not logged into before
  • Any time you login from a country that is different to the country of your last login
• Security benefits of MFA

  MFA helps protect accounts by adding an additional verification step to confirm the identity of users so that even if a cyber-criminal knows an individual’s password, the added layer will stop them accessing user accounts and key information such as:

  • Your name
  • Your address
  • Bank Details
  • Medical Records
  • Your work and files

Enrolling for MFA - Frequently Asked Questions

• Where can I download the Okta Verify app?

  You can download Okta Verify to your smartphone by visiting the Google store (Android), Apple store (iPhone) and the Microsoft store (Windows).

  Once you have installed the app on your smartphone, please watch our device enrolment video guides or visit the Enrolling for MFA page to complete MFA enrolment.

• My smartphone can’t run the Okta Verify app.

  If you do not own a compatible smartphone, please contact the Service Centre (Staff) for assistance.

• I don’t have a smartphone.

  If you do not own a smartphone, please contact the Service Centre (Staff) for assistance.

• I don’t want to download the Okta Verify app on my smartphone.

  I am concerned about my privacy:

  • The Okta Verify App is a third-party application supplied by Okta, our technology partner that is assisting the University to implement MFA at the University of Melbourne.
  • The app has passed through the App Store vetting processes to be available for download
  • The University has no access to the app on your phone and cannot view any of the data on your phone, other apps installed, monitor calls or track your location
  • The app requires internet for push notifications but can also operate offline via the rolling 6-digit code that updates every 30 seconds
  • The app does not require you to link it to a particular phone number
  • You can use Google Authenticator as an alternative if you continue to have concerns

  I am concerned about using my personal smartphone:

  • The University encourages all staff and students to use their personal device for this purpose
  • Providing a University-issued device to each user is not possible due to the high cost
  • Individual requests for a device will continue to be managed through standard University delegations and procurement processes
  • The security provided by MFA greatly enhances the protection of not just University information but also your personal information
  • The use of MFA is a requirement for ongoing access to University services

  I am concerned about the performance impact on my smartphone:

  • The app uses minimal resources on your phone
  • The app prompts you only when Okta needs you to verify your current log in through the app
  • The app can operate offline via the rolling 6-digit code that updates every 30 seconds, this option uses no internet data
  • You can use Google Authenticator as an alternative if you continue to have concerns

  The University encourages all staff and students to use their mobile phone for MFA. The security provided by MFA enhances the protection of both your University and personal information.

• My location blocks access to the Google Play store. What should I do?

  You can manually download and install Okta Verify on your Android smartphone by following these steps:

  1. On your preferred web browser, go to sso.unimelb.edu.au and login with your University username and password.
  2. Select the Setup button for Okta Verify in the 'Setup Multifactor Authentication' area. Then select your device type.
  3. Manually download and install Okta Verify to your smartphone.
     Download link: go.unimelb.edu.au/aw9r
  4. On the Setup Okta Verify screen on your web browser, select the 'Can't Scan?' option. Then, from the dropdown menu, select 'Setup manually without push notification'.
  5. Open the Okta Verify application on your Android device and select Add Account. Then select the 'No Barcode?' option at the bottom of the screen.
  6. Enter your username and the Secret Key displayed on your web browser. Then select Add Account.
  7. Select Next on your web browser, then enter the 6-digit code associated with your University account displayed on the Okta Verify application on your Android mobile device. Then select Verify.
  8. Congratulations! Your account is now registered with Okta Verify. You can now authenticate via the 6-digit codes generated on the Okta Verify application on your Android smartphone.
• Can I use Okta Verify on more than one device?

  Okta Verify app can only be enroled on one device, however The University recommends using Google Authenticator as a backup authentication factor.

  Google Authenticator can be installed on multiple devices.

• What are the minimum requirements for installing Okta Verify on my smartphone?

  Check that your smartphone meets the following requirements:

  • iOS 11.0 compatible device
  • Android version 6.0+
  • Windows Phone version 8.0+

  If you continue to have difficulties, please contact the Service Centre (Staff) for assistance.

• I can’t find Okta Verify in my app store.

  Please check your smartphone compatibility and ensure your device operating system is up to date:

  • iOS 11.0 compatible device
  • Android version 6.0+
  • Windows Phone version 8.0+

  Direct links to app stores: Google store (Android), Apple store (iPhone), Microsoft store (Windows).

  If you continue to have difficulties, please contact the Service Centre for assistance.

• When will I be prompted by Okta Verify?

  Whenever you log into a new device, you’ll receive a prompt notification from your Okta Verify app to ensure it really is you logging in. If you receive a notification for activity that you don’t recognise, you should contact the Service Centre immediately.

  You could be prompted to verify at different times, so make sure you keep your mobile with you.

  Some examples of when you’ll need to authenticate:

  • The first time you login from a browser that you have not logged into before
  • The first time you access your applications from a computer that you have not logged into before
  • Any time you login from a country that is different to the country of your last login
• How can I authenticate using Okta Verify?
  • Push Notification –You will be required to verify your identity by accepting ‘Yes, it’s me’ prompt on your smartphone.
  • 6 digit code (Offline mode) – Alternatively, you have an option to enter the 6 digit code to verify your identity.

  If you require any further assistance, please contact the Service Centre.

• What can I expect from the Okta Verify App?

  A lightweight and secure application

  The Okta Verify app is a lightweight application used to confirm a user’s identity when signing into a key University of Melbourne application. The app is developed by Okta, the University of Melbourne’s technology partner for multifactor authentication (MFA).

  Okta Verify provides an additional security step to verify your identity when you login to key University applications. This extra layer of security protects your user account from unauthorised access.

  Setting up Okta Verify

  The Okta Verify app needs to be downloaded and set up on a compatible smartphone by following a guided process. Once the setup process has completed, the Okta Verify app will display a rolling 6-digit code on your smartphone. At this point you can simply close the app. The use of this code is explained in the next section. You will also receive two emails from Okta confirming your successful enrolment.

  Two ways to verify your identity

  1. Push Notification: When prompted to verify, simply select ‘Yes, it’s me’ on your enrolled smartphone. This requires internet access.
  2. 6-digit code: Sign into a University application in the normal way and select the ‘or enter code’ option on the Okta Verify prompt screen. Now, open the Okta Verify app on your enrolled device and type the 6-digit code provided into the Okta prompt screen on your web browser, then select ‘Verify’.

  The 6-digit code is generated using the industry standard Time-Based One-Time Password Algorithm and is used to authenticate when internet access is unavailable.

  Privacy

  Okta Verify has passed all required vetting both by the App Store and the University. Okta Verify does not store any personal information – it only requires permission to use your device camera to scan a QR code to register your device with Okta.

  For more information, please read the Privacy Collection Notice.

Using MFA - Frequently Asked Questions

• Why is MFA required?

  Students

  Criminals could steal personal information such as passwords, bank details and date of birth. They could also conduct malicious activities, like unenrolling students from courses and stealing money from bank accounts.

  MFA helps keep your personal information and identity protected.

  Staff

  Professional staff are often targeted by phishing campaigns in order to obtain user credentials for accessing applications that contain sensitive University and Staff information.

  MFA helps to protect staff and University data from phishing campaigns.

  Academics

  Our research and intellectual property is extremely valuable and cyber criminals have an active interest in stealing or disrupting that research.

  MFA helps to protect academics and the important work that they do.

• Can I use Google Authenticator instead?

  Yes, however we recommend that you use Okta Verify as your primary authentication factor as you will receive push notifications when verifying your identity.

  Once you have enrolled with the Okta Verify app, Google Authenticator will become available to configure as a recommended backup authentication factor.

  If you wish to use Google as a primary multifactor authenticator, please contact the Service Centre (Staff) for assistance.

• What happens if I delete Okta Verify from my smartphone?

  You can use your backup factor, such as Google Authenticator, to enable you to log back in and reset Okta Verify.

  If you do not have a backup factor, please contact the Service Centre (Staff) for assistance.

• What happens if I get a new smartphone?

  You can transfer multifactor authentication from your previous smartphone to a new one.

  You will need:

  • Your old smartphone
  • Your new smartphone
  • A computer

  1. On the web browser of your computer, go to sso.unimelb.edu.au, enter your login credentials and click on the 'Send Push' button.
  2. You will receive a push notification from Okta on your old smartphone. Select ‘Yes, it’s me’ on your old smartphone to verify your identity.
  3. Once logged in to your account, select the dropdown menu for your account username (located top-right), and select ‘Settings’.
  4. Under the ‘Extra Verification’ section, select the ‘Remove’ button adjacent to ‘Okta Verify’. You’ll then be asked if you want to revoke your existing Okta Verify token. Click ‘Yes’ to continue.
  5. You can now follow the steps provided in the How to Enrol for MFA guide to enrol your new smartphone.
• How do I avoid being prompted by MFA when logging in from home?

  When logging in from a new device or from home, on the Okta Verify user login screen, tick ‘Do not challenge me on this device for the next 90 days’.

• Can I get temporary exclusion from Multifactor Authentication?

  Multifactor Authentication is required for every University of Melbourne staff member and student.

  Temporary exclusion from Multifactor Authentication can only be granted if you temporarily do not have access to your enrolled device and cannot access University applications.

  To request temporary exclusion from Multifactor Authentication, please contact the Service Centre (Staff).

• Okta push notifications and verification codes aren’t working for me?

  The most common reason for Okta push notifications and verification codes failing is a mismatch of the time and date settings on your phone and actual location. Please make sure the time and date settings on your enrolled device match those of your current location.
  
  If you are using an Android mobile device, please enable the 'Automatic date and time update' feature in your Settings.

  On your enrolled device, you can also check the following:

  • Push Notifications have been enabled in the Okta Verify app
  • Your device operating system is up to date and meets the minimum requirements  to support Okta Verify

  Please check the above and try again.

  For further assistance, please contact the Service Centre (Staff).

• How do I reset my Multifactor Authentication factor(s)?

  If you have access to your enrolled device and need to reset your Okta enrolment, please follow the steps provided in the How to Reset Your Okta Enrolment guide.

  The University recommends using Google Authenticator as a backup factor.

  If Okta Verify has been deleted and you are unable to reset your factor manually, please visit sso.unimelb.edu.au and authenticate via your backup factor.

  If you have trouble resetting any factor, please contact the Service Centre (Staff) for assistance.

• I currently don’t have access to my enrolled factor. What should I do?

  If you do not have access to your enrolled device and cannot access University applications, please contact the Service Centre (Staff) for assistance.

• What if I can’t have my enrolled device with me?

  If you work or study in a restricted environment where mobile devices are not allowed, such as University physical containment rooms or science labs, please contact the Service Centre (Staff) for assistance.

• I think my University account may have been compromised. What should I do?

  If you encounter suspicious activity on your University account, please immediately contact the Service Centre (Staff) for assistance:

  Service Centre - Staff

  +61 834 40888
  (7:30am - 7:30pm weekdays)

• I can’t access University mailbox on my iPhone native mail Application. What should I do?

  To access emails on your enrolled iOS 10 or lower device, please go to https://outlook.office.com/mail/inbox on your preferred mobile web browser such as Safari or Chrome or upgrade your device to a newer model that is supported by Apple

  To access emails on your enrolled iOS 11 or iOS 12 device, please delete and re-add your email account on your phone (steps provided in the Changes to Office 365 app use on Apple Devices guide) or go to https://outlook.office.com/mail/inbox on your preferred mobile web browser such as Safari or Chrome.

  For further assistance, please contact the Service Centre (Staff).