University IT
New Microsoft Login + Intune FAQs
Here's a list of common questions about the School of Medicine's transition to a new Microsoft login, which includes connecting devices to Intune.
School of Medicine
Who will use the new Microsoft login?
Currently, this update is being rolled out to the School of Medicine.
This applies to anyone in the level two organization 'VAAA'. You can see the organization list on https://orgcode.stanford.edu/.How will I know when I need to set up the new Microsoft login?
When it's time for you to transition to the new login, you'll receive an email with detailed instructions and support resources. For the School of Medicine, emails will go out the first two weeks in June.
Will this change impact how I log into hospital applications?
If you use your SUNet ID to log into hospital websites and applications like SHC Connect or SHC ServiceNow, you will use the new university Microsoft login experience for these as well.
Microsoft login (General)
Which apps or websites does the new login experience pertain to?
You'll use the new login for all cloud-based Stanford Microsoft 365 (M365) apps, including:
- Productivity and collaboration apps (Word, Excel, PowerPoint, OneDrive, Teams, Forms)
- Stanford email and calendar if you use M365 Outlook, including Outlook desktop, Outlook mobile, and Outlook on the web (webmail.stanford.edu and webcal.stanford.edu)
- Cloud services (Azure, Power BI)
- AI and creative tools (Copilot)
- Windows apps and development tools (Edge, GitHub)
- Security and management (Intune, Entra ID)
The new login will also be used for other applications or websites configured to use Stanford Microsoft authentication.
Do I need to set up the Microsoft Authenticator app?
Your new Microsoft login requires setting up an authentication method — a way to verify your identity when accessing university Microsoft apps. The options below are approved for university use and provide strong security.
- Microsoft Authenticator app– Available for iPhone and Android
- Passkey via Microsoft Authenticator
- Passkey with Touch ID– For Mac users with Touch ID enabled
- YubiKey– Hardware security key option
You can review the instructions and decide which method is best for you.
Can I use other authenticator tools like Google Authenticator or Duo?
No. If you elect to use an authenticator app, you must use Microsoft Authenticator.
Do I have to log into each Microsoft app separately?
No. Once you sign in to your Microsoft account, you'll have access to other M365 services like Teams and OneDrive for your entire session. This single sign-in experience is specific to Microsoft apps.
Will I use Microsoft Authenticator for non-Microsoft accounts?
No, the university is adopting the Microsoft Authenticator app specifically for Microsoft logins. It will work alongside your Duo app, which you will continue to use for other Stanford services, like Slack, Zoom, and Google Drive.
Will I still use Duo?
Yes, for applications and sites that do not use Stanford Microsoft authentication, you'll continue to log in and authenticate the way you do today, using the Duo app for multifactor authentication.
Can I use Apple Watch or Android wearable devices for Microsoft Authenticator?
No. Apple Watch and Android wearable devices (such as Samsung Galaxy Watch) are currently incompatible with Authenticator's security features. However, you can mirror Authenticator notifications from your phone to your wearable device.
How will the Microsoft Authenticator app work if I don't have a mobile device?
Microsoft Authenticator requires a mobile device capable of installing current apps from the Apple App Store or Google Play Store. If you use a Mac with Touch ID, you have the option to use a passkey instead of the app. You can also use a YubiKey security key.
I already have the Microsoft Authenticator app installed on my mobile device. Will there be any conflicts or a different view?
No. Like Duo, you can have accounts from multiple organizations without issue.
When will I see the new Microsoft login process ?
The new login should appear within 24 hours after you complete one of these step to set up your new login:
- Set up the Authenticator app on your phone
- Create an Apple passkey
- Add a Yubikey to your Microsoft account.
If you don't see the new login after 24 hours, contact IT support.
What's the relationship between Microsoft Entra ID and other Microsoft services like Microsoft 365?
This new login is supported by a platform called Microsoft Entra ID.
Microsoft Entra ID (formerly Azure Active Directory) is the identity and access management service that handles authentication for Microsoft services. When you sign in to a Stanford Microsoft service, Entra ID verifies your identity and determines your permissions.
Microsoft login (Troubleshooting)
I received a SAML error while setting up the Authenticator app for passwordless login on my iOS device. What should I do?
If you take too long during the setup process, you may encounter a SAML error due to a session timeout. This timeout issue requires you to remove your Stanford account from the Authenticator app and restart the iOS setup process from Step 2. To resolve the SAML error, follow these instructions to remove an account from Authenticator on an iOS device.
Tip: To avoid this error in the future, complete the setup process promptly without long pauses between steps.
I received a SAML error while setting up the Authenticator app for passwordless login on my Android device. What should I do?
If you take too long during the setup process, you may encounter a SAML error message. This timeout issue requires you to remove your Stanford account from the Authenticator app and restart the setup process. To resolve the SAML error, follow these instructions to remove an account from Authenticator on an Android device.
Tip: To avoid this error in the future, complete the setup process promptly without long pauses between steps.
I've set up my new Microsoft login. Why are some Microsoft third-party apps now asking me to sign in?
You may need to sign in to some apps that connect to Microsoft after you are set up with the new Microsoft login. For example, your LinkedIn in Outlook app may ask you to sign in the next time you open your Outlook calendar. This change will not affect your access to the application itself. The following apps are among those that will likely be impacted:
- Atlassian
- Calendly
- Fizz
- GitHub
- Notion
- Smartsheet
- Spark Mail
- Thunderbird
- VaultMe
What if an application takes me to Entra ID but then has me authenticate Stanford IDP as well?
If you experience an authentication "Double Hop," there is likely a specific setting in the application directing authentications to the Stanford IDP. The application owner will need to take action to adjust the setting.
What if an application takes me to Entra ID but then has me authenticate Stanford IDP as well?
If you experience an authentication "Double Hop," there is likely a specific setting in the application directing authentications to the Stanford IDP. The application owner will need to take action to adjust the setting.
I'm not receiving a verification code when I try to sign in to Microsoft. What should I do?
Verification codes can fail to arrive for a few reasons. You might see a message like "Sign in couldn't be completed" or "We'll help you set up another way to verify it's you." If you're unable to receive a code or complete sign-in, contact IT support.
Here are examples of error messages you might see:
Intune (General)
How will I know it's time to connect my device to Intune?
Windows: Most Windows devices will enroll automatically. However, if your PC isn't eligible for auto-enrollment, you'll get a pop-up notification to launch an app to guide you through the process.
Mac: You'll see a pop-up notification when it's time to start registration.
iPhone, iPad, Linux: You can connect your iOS/iPadOS or Linux device to Intune 24 hours after you start using the new login by following the published instructions.
Which devices need to be connected to Intune?
Each device you use for university work, including:
- Stanford -owned and personal laptops
- Mobile phones (iOS and Andriod)
- Tablets
Complete setup for all devices by July 20. After this date, non-compliant devices may lose access to university M365 services.
Important: Compliance is per device. Setting up one device doesn’t make others compliant. If you use a laptop and a phone to check your university email, both must be connected to Intune.
Should I verify my devices are set up correctly?
Yes! Verification ensures uninterrupted access to email and other university Microsoft services. You can quickly check compliance on the Microsoft Intune Company Portal website. (
How long after enrollment can I verify set up?
After enrollment or registration, it's recommended you allow 24 hours for device records to update.
What about Android devices?
The university already uses Intune device management for Androids. If your device is already enrolled in Intune, you will need to set up Authenticator only. For new Android devices, refer to these instructions for enroll in Intune.
If my Apple device is already enrolled in Jamf for device management, why does it also need Intune?
If your Mac, iPhone, or iPad is already managed by Jamf, it should be registered (not enrolled) in Intune. Registering your Mac or iOS device in Intune will connect it to the new Microsoft login for secure access to apps like Outlook and Teams.
Intune (Troubleshooting)
Why can't I access my Stanford M365 email or any other Microsoft apps on my Windows PC?
This usually happens when your device doesn't meet the university's security requirements for Stanford's Microsoft login. The best fix is to use the Company Portal app. Follow these instructions for Windows PCs to learn how to use the app to scan your computer, identify the steps needed to fix any Microsoft compliance issues, and get back into your email.
Why can't I access Stanford M365 email or any other Microsoft apps from my macOS device?
This usually happens when your device doesn't meet the university's security requirements for Stanford's Microsoft login. Follow these instructions for macOS devices to learn how to fix any Microsoft compliance issues and get back into your email.
Why can't I access my Stanford M365 email or any other Microsoft apps from my iOS (or iPadOS) device?
This usually happens when your device doesn't met the university's security requirements for Stanford's Microsoft login. Follow these instructions for iOS/iPadOS and learn how to fix any Microsoft compliance issues so you can get back into your email.
Why can't I access Stanford M365 email or any other Microsoft apps from my Linux device?
This usually happens when your device doesn't meet the university's security requirements for Stanford's Microsoft login. Follow these instructions for Linux devices to learn how to fix any Microsoft compliance issues and get back into your email.
How do I use the Company Portal website to check Intune enrollment or Microsoft compliance for my device?
Intune enrollment and device compliance can be checked in the Company Portal website. Use these instructions for the Company Portal website from any device (not just the device you're checking). If you can physically access your device, it's best to use the Company Portal app (installed on your device). Refer to these instructions for Windows: How to Remediate Windows Compliance with the Company Portal App.
When I attempt to sign into Stanford Microsoft using Firefox I get an error. What should I do?
To avoid sign-in errors with Microsoft Office 365 applications, you must to support device compliance on Mac and Windows devices. Refer to these instructions to learn how.
When I attempt to sign into Stanford Microsoft on my Windows device, I am getting an error message stating: "Your credentials could not be verified." What should I do?
You can resolve the "Your credentials could not be verified" Windows sign-in error by connecting directly to a campus network or following the temporary workaround steps or permanent resolution steps below. Follow the instructions in the How to Resolve "Your Credentials Could Not Be Verified" Error to learn more.
New or lost device
I have a new phone. How do I set it up with Authenticator?
Do not remove Authenticator from your old device until you have completely set up your new device. Microsoft will continue to use your old device for authentication until the new phone is fully configured with passwordless sign-in.
To ensure you don't lose access to your account during the switch, complete the entire setup process on your new iOS or Android device, including enabling passwordless authentication. You can then follow these steps to remove an Authenticator account from your old device:
I've lost my phone that had the Authenticator app set up. What should I do?
If your phone is lost or stolen, you need to take immediate action to protect your Stanford account and data.
- First, report the lost or stolen device right away using Stanford's Take Action for Lost or Stolen Devices process.
- Once you have a replacement device, submit a Help request to get Microsoft Authenticator set up on your new phone using your Temporary Access Password.
