Microsoft SSO and MFA

Parent or Alumni? You won’t use this login method—start with one of our hubs.

Most services used by current students and employees share a common Microsoft single-sign on (SSO) portal protected by multi-factor authentication (MFA).

Initial sign-in prompt for Microsoft SSO portal

Initial sign-in prompt for Microsoft MFA

In practice, this might mean using your Norse Key and a phone app to sign into your email, and then skipping the sign-in for Norse Hub later on.

Our list of SSO services is long and growing, but here are some—When you sign into any of these services, you’re signed into all the others:

Whenever you’re required to sign in, you’ll be routed to a common login portal at and then returned to your destination. In addition to your Norse Key, you’ll need a one-time code from the MFA method you’ve chosen: app, text, or call.

Set up Multi-Factor Authentication (MFA)

A window with the message "More information required—Your organization needs more information to keep your account secure", followed by a "Next" button

MFA setup prompt

The first time you sign in to any SSO service, you’ll be prompted for “more information”, and then guided through Multi-Factor Authentication setup.

By default, you’ll be guided to set up the Microsoft Authenticator, the best option for most people. Ideally, use a computer to start the setup. In the mobile app, avoid signing in—some of our services won’t work. Instead, choose “Scan QR code”.

In case your primary MFA method is broken or lost, set up a second method like a phone number or another authenticator, ideally one that doesn’t depend on the same device.

If you get locked out or can’t use any of these methods, contact the Technology Help Desk. Here’s how to set up each method:

Note: The Microsoft Authenticator app is only available for mobile devices.

  1. The first time you visit any SSO service, you’ll automatically see setup steps for the Microsoft Authenticator. If this isn’t your first MFA method, at, choose “Add sign-in method” and then “Authenticator app” to get started.
  2. Follow the Authenticator App setup prompts and pause when you see the QR code.
  3. Download the Microsoft Authenticator app on your mobile device (iOS, Android, Windows Phone).
  4. In the app, add a new “Work or school” account.
  5. DON’T sign in to the phone app—instead, choose the Scan QR code setup path.
  6. Lastly, the setup flow will give you a two digit code to enter into the Microsoft Authenticator.
  1. The first time you visit any SSO service, exit the default setup for the Microsoft Authenticator by choosing “I want to set up a different method” on the first screen. If this isn’t your first MFA method, at, choose “Add sign-in method”
  2. Enter a phone number and choose how you’d like to be contacted.
  3. If you choose “Receive a code”, you’ll receive a text with a one-time verification code. Enter the one-time verification code on the multi-factor setup page and click “Done”.
    If you choose “Call me”, you’ll receive a call and will be asked to press the “#” key.
  1. Begin setup for the Microsoft Authenticator, but choose “I want to use a different authenticator app” on the first screen. 
  2. Pause when you see the QR code and begin the new account setup process in your authenticator app.
  3. If your authenticator app can scan QR codes, scan the new code; otherwise, click “Can’t scan” and enter the alphanumeric “Secret Key” into your authenticator. If successful, your authenticator should display a 6 digit numeric code that cycles every 30 seconds.
  4. After you click next on the original MFA setup page, you’ll be prompted for the rotating code from your authenticator app. If successful, you should be taken back to the main setup screen.


When you’re prompted for your MFA option, choose “Other ways to sign-in” at the bottom of the prompt. If you don’t see any other viable methods, call the Technology Help Desk and we can help you set one up.

Call the Technology Help Desk and we can give you a one-time passcode or reset your MFA settings.

If you don’t have a phone number at all, we recommend the browser extension for your computer. Set it up using the “other authenticator app” instructions above. If that still doesn’t work for you, contact the Technology Help Desk.

Many institutions use this same login process and they all go through the same portal at This error means that you’re signed into your account at one of those other institutions and it’s causing problems. Go to and in the upper right, choose “sign out” or “add account”.

You’ve chosen to use a passwordless sign-in at some point and you’re encountering a service where that isn’t valid. Go to, remove the passwordless authentication method, and sign out (in the upper right). Sign in to your destination service again.

It’s important to know that rotating six-digit verification codes are time based, and that each code only covers a 30 second window. Our first recommendation is to wait until a new code is generated so that you have the full 30 seconds to complete the sign-in or setup process. If that still doesn’t work, make sure that the clock and time zone on both devices are exactly the same. Also make sure your clock is getting the correct time “automatically” rather than using a manual setting.

Technology Help Desk

Preus Library
Main Level
700 College Dr
Decorah, IA 52101

Summer Hours

May 17-September 2

Closed for Memorial Day, Independence Day, Juneteenth
M-Th: 8:00 am – 5:00 pm
F: 8:00 am – 2:30 pm
Sa-Su: Closed

Full Hours

Phone: 563-387-1000