As part of our ongoing efforts to strengthen account security, Okanagan College is moving away from SMS (text message) authentication and encouraging all students and staff to use more secure authentication methods, including the Microsoft Authenticator app and passkeys.
SMS authentication has served as a convenient option for many years, but it is no longer considered a best practice for protecting online accounts. Modern authentication methods provide significantly stronger protection against phishing attacks, account takeover attempts, and other cyber threats.
Why Is SMS Being Retired?
Microsoft is officially retiring SMS authentication in February 2027 and encouraging organizations to use more secure sign-in methods, such as the Microsoft Authenticator app and passkeys.
In addition to being phased out by Microsoft, SMS authentication is less secure than newer sign-in methods. Text messages can be intercepted or targeted through attacks such as SIM swapping, where a cybercriminal tricks a mobile provider into transferring your phone number to a different SIM card. This can allow them to receive your calls, text messages, and multifactor authentication codes. SMS authentication is also more vulnerable to phishing attacks than modern authentication methods such as Microsoft Authenticator and passkeys.
To help keep Okanagan College accounts secure and align with Microsoft's security recommendations, OC is moving users away from SMS authentication and toward stronger options such as:
- Microsoft Authenticator
- Passkeys in Microsoft Authenticator
- FIDO2 security keys (such as YubiKeys)
- Other approved passwordless authentication methods
These newer methods provide better protection against online threats while also making sign-in faster and easier.
For more information about MFA at OC, visit the Multi-Factor Authentication (MFA) page.
What Are Passkeys?
A passkey is a secure digital credential that can replace your password and provide a faster, more secure sign-in experience.
Instead of typing a password and entering a verification code, you sign in using a trusted device and unlock it with a fingerprint, facial recognition, device PIN, or security key.
Passkeys are:
- More secure than passwords and SMS codes
- Resistant to phishing attacks
- Faster and easier to use
- Stored securely on your trusted device
Learn more about passkeys on the Passwordless Authentication Using Passkeys page.
Recommended Options for Students
Students have several passkey options available to them:
Microsoft Authenticator Passkey (Recommended)
The Microsoft Authenticator app can store a passkey for your OC account, allowing you to sign in securely using your phone's biometric authentication or device PIN.
This is the authentication method most commonly recommended and supported by the IT Help Desk.
FIDO2 Security Keys
Students may also use a FIDO2 security key, such as a YubiKey. These are physical hardware devices that store your passkey and provide strong phishing-resistant authentication.
Synced Passkeys
Students may choose to use synced passkeys provided by services such as:
- Apple iCloud Keychain
- Google Password Manager
- Other supported password manager platforms
These solutions can make it easier to access your passkeys across multiple personal devices.
Please note that while students may use synced passkeys, the IT Help Desk does not provide setup or troubleshooting support for third-party synced passkey platforms.
Important Information for Staff
Staff should not be using SMS authentication and are expected to use stronger authentication methods instead.
Staff may use:
- Microsoft Authenticator
- Passkey in Microsoft Authenticator
- FIDO2 security keys
For security reasons, staff are not permitted to use synced passkeys stored in services such as iCloud Keychain or Google Password Manager. Staff must use device-bound passkeys, which provide a higher level of assurance and protection for institutional accounts.
What Support Does the IT Help Desk Provide?
The IT Help Desk is happy to assist with:
- Setting up Microsoft Authenticator
- Registering or updating supported MFA methods
- Resetting MFA methods if you lose access to your device
- Regaining access when an authentication method stops working
The IT Help Desk does not provide support for:
- Setting up iCloud Keychain passkeys
- Setting up Google Password Manager passkeys
- Configuring third-party password managers or synced passkey services
If you choose to use a synced passkey as a student, you will be responsible for managing and maintaining that solution yourself.
What Should You Do Now?
If you're currently relying on SMS authentication, now is the perfect time to move to a stronger authentication method before SMS support is retired.
We recommend to:
- Review and update your authentication methods through your OC account's Security Info page.
- Choose a secure MFA method that works best for you.
- Contact the IT Help Desk if you need assistance resetting or updating your MFA methods.
Learn More
Multi-Factor Authentication (MFA)
Read the MFA guide
Passwordless Authentication Using Passkeys
Learn about passkeys
Strong authentication is one of the simplest and most effective ways to protect your account. By moving away from SMS and adopting phishing-resistant authentication methods such as Microsoft Authenticator and passkeys, you're helping keep your personal information and Okanagan College systems secure.