Article Intended For
Penn State employees, students, and other affiliates who want help choosing which multifactor authentication (MFA) method(s) best meets their needs.
Introduction
Penn State supports several ways to securely sign in to your Penn State Account using MFA. The best option for you may depend on the devices you use, whether you want your passkey to sync across devices, and how you prefer to sign in. Whichever method you choose, creating a passkey is easy and should only take a few minutes to complete.
Synced passkeys are the recommended method of MFA at Penn State. Synced passkeys provide phishing-resistant authentication and remain available if you replace or upgrade your smartphone or tablet.
NOTE: Regardless of the MFA method you choose to regularly use, it is highly recommended that you enroll a second method in the event your primary device (smartphone, tablet, FIDO2 key, etc.) is lost, stolen, or otherwise not available.
Article Body
Which Option Should I Choose?
I use an iPhone or iPad
Choose: Apple Passwords
Your passkey is securely synced through your Apple Account and is available on other compatible Apple devices using the same account. If you lose, replace, or upgrade your device, your passkey remains available through your Apple Account.
See: MFA: Enroll a Passkey With My iPhone or iPad (synced to Apple Passwords)
I use an Android phone or tablet
Choose: Google Password Manager
Your passkey is securely synced through your Google Account and is available on other compatible Android devices using the same account. If you lose, replace, or upgrade your device, your passkey remains available through your Google Account.
See: MFA: Enroll a Passkey With My Android Phone or Tablet (synced to Google Password Manager)
I currently use a password manager
Choose: 1Password, Bitwarden, or LastPass
If you already use one of these supported password managers, you can store your Penn State passkey there. Your passkey will sync through your password manager and is available across your devices.
NOTE: If you currently use a password manager that is not listed above, it likely works with your Penn State Account. However, if you experience any issues while using it, Penn State IT support will not be able to assist you with it, and you will need to contact the company directly. That said, you can contact the Penn State IT Service Desk for a temporary login pass until your issue with the password manager is resolved.
See:
MFA: Enroll a Passkey and Sign In With Bitwarden Password Manager
MFA: Enroll a Passkey and Sign In With LastPass Password Manager
I want my passkey to remain only on my smartphone
Choose: Microsoft Authenticator Passkey
Microsoft Authenticator stores a device-bound passkey on your smartphone. Unlike a synced passkey, it remains on the device where it was created and does not sync to other devices.
If your phone is lost, replaced, or reset, the passkey will not automatically be available on your replacement device.
See: MFA: Enroll a Passkey With Microsoft Authenticator (iOS or Android)
I prefer to continue entering my password
Choose: Microsoft Authenticator Number Matching
If you are not required to use phishing-resistant MFA, you can continue signing in with your Penn State password and approving the sign-in using Microsoft Authenticator.
Number matching provides strong MFA but is not phishing-resistant because your password is still used during sign-in.
NOTE: Penn State IT employees are required to use phishing-resistant MFA and cannot use number matching to satisfy this requirement.
See: MFA: Push Notification Enrollment
I want to use my personal Windows computer
Choose: Windows Hello
Windows Hello allows you to store a device-bound passkey directly on a supported Windows computer. You can then use your Windows Hello PIN, fingerprint, or facial recognition to verify your identity when signing in.
Because the passkey is device-bound, it remains on that computer and does not sync to other devices (such as a lab computer or a podium).
See: MFA: Enroll a Passkey in Windows Hello on a Personal Windows Computer
I want to use my personal Mac computer
Choose: Apple Passwords
If your Mac supports Touch ID, you can use it to verify your Penn State Account passkey synced to the Apple Passwords app.
See: MFA: Enroll a Passkey on a Personal macOS Computer and Use Touch ID
I use a Penn State-managed Windows computer (employees)
Choose: Windows Hello for Business
Windows Hello for Business provides phishing-resistant authentication on supported Penn State-managed Windows laptops and desktops. You can use your Windows Hello PIN, fingerprint, or facial recognition to verify your identity. While PIN is always an option, availability of fingerprint and facial recognition depends on your computer's hardware.
NOTE: If your computer is managed by the Unified Endpoint Management (UEM) group, Windows Hello for Business should be available for you to use. If your computer is not managed by UEM and you would like to use Windows Hello for Business, you will need to contact your local IT group (or whoever manages your computer) first and request that they enable it for your laptop/desktop computer. If you are not sure who that is, please contact the IT Service Desk for assistance.
See: MFA: Enroll in Windows Hello for Business on a Penn State-Managed Windows Computer
I use a Penn State-managed Mac computer (employees)
Choose: Platform SSO
Platform SSO allows you to use your Penn State-managed Mac's built-in authentication, such as Touch ID, to securely sign in to your Penn State Account.
NOTE: You will need to contact the IT group (or whoever manages your computer) first and request that they enable Platform SSO for your macOS computer. If you not sure who that is, please contact the IT Service Desk for assistance.
See: MFA: Enroll in Platform SSO on a Penn State-Managed Mac Computer
I want a separate physical device or a backup authentication method
Choose: FIDO2 Security Key (example: YubiKey)
A FIDO2 security key, such as a YubiKey, stores your passkey directly on a physical key and can be used without relying on your smartphone or computer.
A security key is also a great option for a secondary or backup authentication method. If you normally use a passkey stored on your smartphone, a registered security key provides another way to access your Penn State Account if your primary device is lost, damaged, or otherwise unavailable.
Security keys are typically inserted into a USB slot on your computer or phone (depending on whether you have a USB-A or USB-C type). Many security keys also support Near Field Communication (NFC) which is a contactless technology similar to tap-to-pay. If your smartphone supports NFC, you can sign in directly on your device by simply holding the key against your phone.
See: MFA: Enroll a Passkey With a FIDO2 Security Key (YubiKey)
I want to receive a phone call or text message
Choose: Any of the alternate methods listed above
As of February 1, 2027, Microsoft (Penn State's sign-in provider) will no longer offer telephony methods for authentication. Phone calls and SMS/text messages will no longer be available.
Where can I learn more?
You can learn more about passkeys and phishing-resistant MFA in the following KB articles: