Information Technology
Version: 3 (03/31/25)
Enrolling in Multi-Factor Authentication (MFA) Using Microsoft Authenticator Procedure
Important Information
Multi-Factor Authentication (MFA) is a security measure that can help prevent unwanted access to your City accounts and associated information. This article describes how to enroll in MFA using the Microsoft Authenticator app.
Note: Please take a look at the list of common pitfalls and tips we have added at the bottom of the page. You may want to read these before you begin, and they might be helpful if you get stuck.
How to Enroll in MFA Using Microsoft Authenticator Procedure
Before you begin:
Be in front of your computer AND have your smartphone ready.
You will need both, after downloading the app, set it aside, and use your computer until you reach the QR code, then you will use your phone (and the app, to move forward scanning the app).
Step 1. On your phone: Download the app to your phone
Already have the MS Authenticator on your phone? Then skip to step 2 (Don't open the app yet, and don't sign in to the app).
You can download the Microsoft Authenticator app from the Apple app or Google play store. If you're using a City-owned non-shared phone, you can open "App Cat" on your home screen to download Microsoft Authenticator. Don't open the app yet.
- Depending on the device you are using (see table below), download the app from one of the following places using a QR code/ link below, or by searching for "Microsoft Authenticator" in the respective device's App repository:
Personal iPhone or iPad
Personal Android phone or tablet
City-issued iPhone or iPad
Apple App Store
Google Play Store
Intelligent Hub-Apps
Apple App Store - Microsoft Authenticator - iOS/ iPadOS
Google PlayStore - Microsoft Authenticator - Android
Intelligent Hub - Microsoft Authenticator - City-owned & Managed iPhone/ iPad
- Look for Microsoft Authenticator - the app icon will look like this:
Note: Once the app is installed, STOP; do not open the app yet. Do NOT sign into the app. Put your phone down, and go to your computer.
Proceed to the next step (on your computer).
Step 2. On your computer
- Do you see this screen? If you do, skip to step 2D; if not, continue to step 2B
- In a browser, visit aka.ms/mfasetup and log in with your City credentials. Then STOP
- If you see this screen, skip to Troubleshooting, Section B; if not, proceed to next step
- We've downloaded the app, so just hit next
- Be sure to have your phone nearby, and hit next on this screen; proceed to step 3
Step 3. Pause and pick up your phone
- When you get to the screen below, STOP, pick up your phone, and open the Microsoft Authenticator (see step 4)
Step 4. On Your Phone
Open the Microsoft Authenticator App
- You may have to tap "Agree" or "Accept" for Microsoft to have basic access to app data
- You should see the screen below, IMPORTANT: Do NOT sign in; instead, look for a button to scan QR code within the app. See images below. You may have to tap the "+" sign to add a new work or school account first.
- If you do not see the screen shown in 4B, then tap the "+", then tap Work or school account. Finally, tap Scan QR code button.
Move back to your computer for the next step.
Step 5. On Your computer
- Hold your phone in front of the QR code shown on the screen of your computer. You may see several prompts on your phone after scanning the QR code within the Authenticator app.
- After scanning the QR code, you may also see a pop-up to "approve" the authentication. Click "Approve". If not, continue to step 6.
Note: Having trouble scanning the code? Skip to Troubleshooting Section A
After scanning the QR code, set your phone aside (but nearby and within decent signal/internet connection) and move back to your computer for the next step below...
Step 6. On your computer
- Click "Next" on your computer, which should then trigger the Sign-in Approval prompt on your phone to enter the number that is displayed on the computer screen.
Note: Having trouble getting a prompt? Skip to Troubleshooting Section A.
Step 7. On Your Computer
You should see a checkmark after approving the prompt on your phone. Click "Next", then finish up by clicking "Done". You may be prompted to log in again on your computer. Make sure to log back in if so.
If you are prompted to log in again on the computer- go ahead and do so. Be ready with your phone, Authenticator app open, to approve the prompt.
After completing the process, you should end up on this page on your computer. If the phone you just enrolled is listed, then you are done!!
Congratulations, you are enrolled in MFA!
Step 8. Optional: Turn off App Lock
By default, unless you've already turned it off- Microsoft Authenticator will prompt you for your phone lock code, biometric unlock, or pattern unlock. You may also be prompted for the same after each sign-in approval. If you would like to turn off the extra step, please see below for Android and iPhone instructions.
Android- turn off App Lock
iPhone- Turn off App Lock
Troubleshooting
Section A. QR Code Timed Out
If you wait too long on the QR Code window, you will see an error like this. The QR code is time sensitive and has timed-out.
Section B. Previously set up Authenticator/MFA Methods
You may have set up Authenticator previously. If so, you will need to remove your current Authenticator methods.
Common Pitfalls and Tips Shared About MFA Enrollment
- You will need both your phone AND your computer to enroll- they will both need to have stable internet connections to complete enrollment. Pay close attention to the notes in the instructions above and on which device it is denoted you are using at that particular step.
- Be sure you are downloading Microsoft Authenticator- there are many copy cat apps that look very similar. Double-check before installing on your mobile phone and uninstall any "Authenticator" app you may have downloaded by mistake.
- The QR to enroll, that you are asked to scan in the instructions above, MUST be scanned from the Microsoft Authenticator app. Attempting to use your camera app, or some other QR code scanner will not work. If you are having trouble scanning from the Authenticator app, make sure you have NOT tried signing into the app itself. You will want to ALWAYS choose scan QR code when presented with the option in the Microsoft Authenticator app- if you are asked to sign in, cancel, go back, or completely close the app and try again.
- Do NOT sign into the app. Despite being given the option to sign-in while in the Microsoft Authenticator app, do not do so. You should only use the Scan QR code options, as shown in the instructions above.
- Once you scan the QR code successfully- your phone should display a screen as shown in step 5A, and read "City of Fort Collins", with your email shown below that. Once you see this, move back to your computer to complete the rest of the steps (clicking "Next" to move forward from the QR code screen, Step 6)
- If you have not received an "Approve" or "Deny" prompt on your phone screen, initiated from your computer once you have scanned the code and hit "next", then you have not completed enrollment (see Step 6).
-
If you are seeing Time Out related errors, be sure that you have your phone next to you, and that it has an adequate connection to the internet. You will need to tap "Approve" in Microsoft Authenticator that will be sent from the process you are going through on your computer (see Step 6).
- The QR code is unique and time-sensitive. It cannot be re-used, and after about 5 minutes of being displayed on screen, it expires, at which point you may need to refresh the page and sign in again.
- Are you being prompted for your TouchID, pattern password, or a passcode each time you open the Authenticator app or try to approve a sign-in prompt? We've got you covered - see Step 8 above to learn how to turn that feature off for ease of future approvals.
Notes
- Visit mysignins.microsoft.com to see security information such as recent logins.
- Frequency of authentication: Once enrolled, you may be initially prompted to authenticate multiple times over a day, but that will not be the norm since authorizations are good for 30 days or until you change your password. People seem to be prompted per application (not all) per device network. It is annoying if you are not expecting it, but it does not last long and a simple tap on your phone gets you where you need to go quickly. IT is exploring options to reduce the number of authentication prompts.
Further Knowledge
Links to related knowledge base articles, videos, or how-tos
Getting Help
If you encounter any issues or have any further questions, please contact your IT Service Desk by creating a ticket at https://support.fcgov.com/support/home