About Employee Multi-Factor Authentication

Current Duo token holders will receive an email when it’s time to pick up their new Microsoft SafeID token. Tokens are already available and can be picked up anytime at the Burnaby ITS Service Desk.

If you work at a satellite campus/school, please contact your local Administration office to arrange your token exchange.

After receiving your new token, follow the steps in the next panel to complete setup.

Once you have your SafeID token, you can register it yourself by following the steps in the student article: Setting up and testing a SafeID token.

Just note that in Step 2, you’ll need to enter your BCIT employee email address (ending in @bcit.ca).

If you’re both an employee and a student at BCIT, you’ll have two separate accounts — one for work (ending in @bcit.ca) and one for your studies (ending in @my.bcit.ca). Each account requires its own multi-factor authentication (MFA) method.

If you’re using a SafeID token for your employee account, you can either:

• Purchase a second SafeID token from the BCIT Bookstore for your student account, and use your student email to follow the setup instructions provided.

  or

• Use the Microsoft Authenticator app for your student account instead, to avoid carrying two tokens. Follow these instructions for your student account.

Tip: We recommend using the Microsoft Authenticator app whenever possible, as it’s more secure and easier to manage than a hardware token.

Multi-factor authentication (MFA) adds an extra layer of security by requiring more than just your BCIT password to sign in. After entering your credentials, you’ll also verify your identity using a second method — typically a mobile app (Microsoft Authenticator) or a hardware token.

MFA helps protect your account from unauthorized access, even if your password is compromised. It’s a key cybersecurity best practice and plays a critical role in keeping BCIT systems and data secure.

BCIT is working to simplify and strengthen its IT systems by leveraging the full benefits of Microsoft 365 (M365). A key part of this effort is improving how we manage secure access through multi-factor authentication (MFA).

To support this, BCIT is transitioning from Duo to Microsoft Authenticator. This change offers several advantages:

• Streamlined login experience across Microsoft 365 tools and BCIT systems.
• Consistency for all users, as students already use Microsoft Authenticator.
• Simplified support and setup with a single MFA platform.
• Ongoing security improvements through Microsoft’s regularly updated technologies.

While Duo has served us well, Microsoft Authenticator better supports BCIT’s current systems and future direction. Our goal is to make it easier for you to stay secure with a seamless and familiar login process.

Number matching offers a more secure authentication method compared to Duo MFA by directly addressing the risk of “MFA fatigue” and preventing accidental approvals. In traditional push notification methods, like those used by Duo, users can inadvertently approve a login request simply by tapping “approve” without carefully reviewing the details. Number matching mitigates this risk by requiring users to manually enter a specific number displayed on the login screen into their authenticator app. This ensures that users are actively engaged in the authentication process and are verifying the legitimacy of the request, significantly reducing the likelihood of phishing attacks and unauthorized access. The added step of manual verification makes number matching a stronger defense against modern security threats.

Multi-factor authentication is required to access all BCIT services and applications. It plays a vital role in protecting BCIT systems and data, helping ensure secure access to the tools and resources you use every day.

Logging in to BCIT Tools and Systems (Faculty & Staff)

Not very often. Most users can choose the “Remember this device” option, which means you’ll typically only be prompted to complete MFA once or twice a day..

You may be asked to authenticate more frequently if you:

• Use multiple devices or browsers.
• Open incognito or private windows.
• Restart your device often.
• Access a wide range of apps throughout the day.

Starting August 25, 2025, employee and student accounts will be separated. This change strengthens access management, ensures each account only connects to its intended systems, and enhances the protection of your data and cybersecurity at BCIT.

If you’ve already set up MFA for your student email account, you’ll need to complete a separate MFA setup for your employee email account — and vice versa.

For more information, please refer to the following articles:

• Using the right BCIT account: If you are an Employee and a Student
• Onboarding considerations for Student Employees