University IT
Transitioning to a New Login for Microsoft
Modernizing your login experience
The university is rolling out a modern, more secure login to better protect your Stanford Microsoft 365 (M365) account and the university data you work with. It will also make it easier and safer for you to collaborate with colleagues across the entire Stanford community.
When will you use it? Once you set up the new M365 login, you'll be prompted to use it whenever you sign into Stanford Microsoft services, including email if you use M365 email.
What won't change? For everything else—like Google, Zoom, Slack, and the Cisco VPN—your login will not change. You'll sign in just like you always have.
| Applications and sites transitioning to the new Stanford Microsoft authentication include: | Stanford authentication remains unchanged for non-Microsoft applications and sites, including: |
|---|---|
|
|
At a glance: Login with the Microsoft Authenticator app
To set up the new process, many of you will install the Microsoft Authenticator app on your phone. This app works alongside your Duo app, but doesn't replace it. You'll still use Duo for other (non-Microsoft) university and hospital logins.
Check out the table. See how your Stanford Microsoft login experience with Authenticator compares to your login with Duo.
macOS users: If your device has Touch ID, you can create a passkey instead of installing the Authenticator app. Expand the section below to learn more about how passkeys work.
| Feature | For Stanford Microsoft apps | For other Stanford apps and web sites |
|---|---|---|
| Login screen | Stanford Microsoft login screen
| Stanford login screen
|
| Username | SUNetID@stanford.edu | SUNet ID |
| Passwordless login |  Supported by Microsoft Authenticator |  Supported by Cardinal Key |
| Two-step authentication | Using Microsoft Authenticator What you see on your computer
What you see on your mobile device
| Using Duo What you see on your computer
What you see on your mobile device
|
| Single sign-on | Log in once with the Microsoft login to access multiple Microsoft applications throughout the day | Log in once with the Stanford login to access multiple websites and applications throughout the day |
If you use a Mac with Touch ID, you can set up a passkey on your Mac that syncs to iCloud. Once that's done, a simple Touch ID is all you'll need to access your university Microsoft services on your iPhone, iPad, and Mac.
Check out the table to see how your Stanford Microsoft login experience with a passkey compares to your login with Duo.
| Feature | For Stanford Microsoft apps | For other Stanford apps and web sites |
|---|---|---|
| Login screen | Stanford Microsoft login screen
| Stanford login screen
|
| Username | SUNetID@stanford.edu | SUNet ID |
| Passwordless login |  Supported by Apple iCloud | Supported by Cardinal Key |
| Two-step authentication | Using Passkey What you see on your computer
Complete touch ID process
| Using Duo What you see on your computer
What you see on your mobile device
|
| Single sign-on | Log in once with the Microsoft login to access multiple Microsoft applications throughout the day | Log in once with the Stanford login to access multiple websites and applications throughout the day |
Getting started is simple. Before you log in for the first time, you'll do a quick, one-time setup of the Microsoft Authenticator app on your mobile device. (If you use a Mac with Touch ID, you can set up a passkey instead of the app.)
Step-by-step instructions will be posted here soon.
Who will use the new Microsoft login?
Currently, this update is being rolled out to the School of Medicine.
How will I know when I need to set up the new Microsoft login?
When it's time for you to transition to the new login, you'll receive an email with detailed instructions and support resources.
Which apps or websites does the new login experience pertain to?
You'll use the new login for all cloud-based Stanford Microsoft 365 (M365) apps, including:
- Productivity and collaboration apps (Word, Excel, PowerPoint, OneDrive, Teams, Forms)
- Stanford email and calendar if you use M365 Outlook, including Outlook desktop, Outlook mobile, and Outlook on the web (webmail.stanford.edu and webcal.stanford.edu)
- Cloud services (Azure, Power BI)
- AI and creative tools (Copilot)
- Windows apps and development tools (Edge, GitHub)
- Security and management (Intune, Entra ID)
The new login will also be used for other applications or websites configured to use Stanford Microsoft authentication.
Do I need to set up the Microsoft Authenticator app?
Not necessarily. When you receive your setup email, you'll see you have four options:
- Microsoft Authenticator app– Available for iPhone and Android
- Passkey via Microsoft Authenticator
- Passkey with Touch ID– For Mac users with Touch ID enabled
- YubiKey– Hardware security key option
You can review the instructions and decide which method is best for you.
Do I have to log into each Microsoft app separately?
No. Once you sign in to your Microsoft account, you'll have access to other M365 services like Teams and OneDrive for your entire session. This single sign-in experience is specific to Microsoft apps.
Will I use Microsoft Authenticator for non-Microsoft accounts?
No, the university is adopting the Microsoft Authenticator app specifically for Microsoft logins. It will work alongside your Duo app, which you will continue to use for other Stanford services, like Slack, Zoom, and Google Drive.
Will I still use Duo?
Yes, for applications and sites that do not use Stanford Microsoft authentication, you'll continue to log in and authenticate the way you do today, using the Duo app for multifactor authentication.
Will this change impact how I log into hospital applications?
If you use your SUNet ID to log into hospital websites and applications like SHC Connect or SHC ServiceNow, you will use the new university Microsoft login experience for these as well.
Can I use Apple Watch or Android wearable devices for Microsoft Authenticator?
No. Apple Watch and Android wearable devices (such as Samsung Galaxy Watch) are currently incompatible with Authenticator's security features. However, you can mirror Authenticator notifications from your phone to your wearable device.
How will the Microsoft Authenticator app work if I don't have a mobile device?
Microsoft Authenticator requires a mobile device capable of installing current apps from the Apple App Store or Google Play Store. If you use a Mac with Touch ID, you have the option to use a passkey instead of the app.
I already have the Microsoft Authenticator app installed on my mobile device. Will there be any conflicts or a different view?
No. Like Duo, you can have accounts from multiple organizations without issue.
What if an application takes me to Entra ID but then has me authenticate Stanford IDP as well?
If you experience an authentication "Double Hop," there is likely a specific setting in the application directing authentications to the Stanford IDP. The application owner will need to take action to adjust the setting.
What's the relationship between Microsoft Entra ID and other Microsoft services like Microsoft 365?
This update login is supported by a platform called Microsoft Entra ID.
Microsoft Entra ID (formerly Azure Active Directory) is the identity and access management service that handles authentication for Microsoft services. When you sign in to a Stanford Microsoft service, Entra ID verifies your identity and determines your permissions.
Support information for the School of Medicine rollout will be posted soon.
