You can change your password using the Manage your Account link on the CUNY Login page or by going to managelogin.cuny.edu in a web browser.

See Change my CUNY Login Password for instructions.

Contact the ITS Helpdesk immediately for assistance by phone at 718-951-4357 or by submitting a support request.

TIP: Before trading in or disposing of your old device, make sure to add your new device or a different device as a multi-factor authentication (MFA) option from the CUNY MFA Self-Service page.

Follow these instructions to set up and use your phone as a FIDO2 authentication factor for CUNY Login MFA.

• Setting Up and Using Your iPhone as a CUNY Login MFA FIDO2 Factor
• Setting Up and Using Your Android Phone as a CUNY Login MFA FIDO2 Factor

Here are a few options for users who wish to implement MFA on their Mac computers:

• Proton Authenticator (available on the Mac App Store) — Getting Started Guide
• Step Two (available on the Mac App Store) — Setup Guide
• Passkeys using your Apple ID
  (Select the FIDO2 Challenge option when adding an authentication factor)

You see the error page when trying to access applications using your CUNY Login:

It’s likely that you didn’t complete the CUNY Login MFA set up process. Please follow the setup guide or video carefully to get started with your configuration.

You see the error page while following the setup instructions or video:

1. It’s possible that your CUNY Login MFA is locked due to multiple attempts during set up.
2. You used an exclamation point (!) as part of your friendly name which is not supported.

Please contact the ITS Helpdesk for both of these issues and mention that your CUNY Login MFA needs to be reset.

If you followed the instructions on how to setup your CUNY Login Multi-Factor Authentication (MFA) verification, you can find the verification code that you need in your Microsoft Authenticator app (or which ever authenticator you are using).

Here is the typical process that you will use when singing in to applications that use CUNY Login:

1. Sign in with your CUNY Login credentials

2. If this the first time you are being asked to enter your code, a window is displayed prompting you to choose your MFA login method from the displayed list of Mobile Authenticator devices. (If you are also prompted to share your location with ssologin.cuny.edu, click Allow.)
   
   Select the MFA verification option you previously configured when following the setup guide. For example, CUNY Login MFA.
   
   Enable the Remember Choice option to avoid having to choose a method each time you sign in. You will go straight to entering your code the next time you sign in.

3. A window labeled TOTP will pop-up prompting you to enter your OTP code. (The OTP code is your one-time password — the six-digit verification code that is randomly generated every 30 seconds in your authenticator app.)

4. Open the Microsoft Authenticator app on your mobile device and find the code listed for CUNY Login MFA (or whatever name you chose during your setup).

Note: New 6-digit verification codes are randomly generated every 30 seconds. If your code changes while you are entering it, enter the new code.

5. Enter the six digit code from Microsoft Authenticator in the space provided for your OTP code and click Verify.

6. The CUNY application or service should open for you to use.

CUNY requires Multi-Factor Authentication (referred to as MFA) for all student CUNY Login IDs. You need to install and use a supported authenticator app and enter a verification code every time you sign in to an application or service that requires your CUNY Login, including CUNYfirst, Brightspace, Navigate Student, Microsoft 365 (Email), DegreeWorks, and FACTS. This change is separate from the multi-factor authentication that you already use for your college email account on Microsoft 365.

Frequently Asked Questions

Q: What is MFA?
A: MFA (Multi-Factor Authentication) adds extra security to your account by requiring you to verify your identity beyond just a password using a device that you own (like your phone with an authenticator app).

Q: Is CUNY Login MFA the same as Microsoft 365 MFA?
A: No. CUNY Login MFA is separate and only used for logging into CUNY systems. Microsoft 365 MFA is only for Microsoft apps like Outlook, Teams, and OneDrive.

Q: Can I use the same authenticator app I use for other services?
A: If you’re using a supported app like Microsoft Authenticator or Google Authenticator, you can add your CUNY Login account—no need to install a new app.

Q: What if I don’t have a mobile phone capable of running an authenticator app?
A: If you don’t have access to a smartphone, you can use Oracle Mobile Authenticator App on a Windows PC (Mac is not supported by Oracle). Using email, voice calls, or text messages for CUNY Login MFA is not supported. Here are some MFA options for Mac OS.

Q: How often will I need to enter a verification code?
A: Every time you sign in to a system that uses your CUNY Login credentials.

Q: How do I find my CUNY Login verification code after I complete the setup process?
A: When prompted for your verification code after signing in with your CUNY Login, open the Microsoft Authenticator app on your mobile device and enter the code for CUNY Login. A new code is generated every 30 seconds

Q: My CUNY Login MFA device was lost, stolen, or replaced.
A: If you no longer have access to the device you used for CUNY Login MFA verification (due to loss, theft, or device change), your CUNY Login MFA will need to be reset. Contact the ITS Helpdesk immediately for assistance by phone at 718-951-4357 or by submitting a support request.

Q: How to respond to CUNY Login MFA requests and prompts?
A: See the guide: How to respond to CUNY Login MFA requests and prompts

If you have questions or need help setting up your CUNY Login MFA, contact the ITS Helpdesk.

Video Walkthrough

This video walks through the entire CUNY Login MFA setup process. You can also follow the written steps below.

Step-By-Step Setup Guide

1. Download and install the Microsoft Authenticator app on your mobile device. (If you already have the app installed, you can skip this step.)
   
   Note: CUNY Login MFA does not support using text messages, email, or voice calls as verification options. If you don’t have a smartphone, you can use the Oracle Authenticator App on a Windows 11 PC. If you don’t have access to a Windows PC, please contact the IT Helpdesk for assistance.)

2. Open the Microsoft Authenticator App on your mobile device.  We will return to the mobile app later on in this guide.

3. On your computer: Open the Google Chrome or Microsoft Edge web browser and go to the CUNY MFA Self-Service page (https://ssologin.cuny.edu/oaa/rui).
4. If prompted, log in using your CUNY Login username and password.
   – If you are already signed in, you will skip to step 6 automatically. Click Allow.
   – Allow location sharing, if prompted)

5. Click OK to continue.

6. Click Allow on the next page:

7. On the next page under My Authentication Factors click on Manage:

8. Click on Add Authentication Factor to display the list of authentication factor methods.

9. Choose Mobile Authenticator – TOTP (Time-based One-Time Password).

10. In the Friendly Name field, enter an informative name like CUNY Login MFA so you can easily distinguish the CUNY Login MFA code from other accounts in Microsoft Authenticator. Do not use special characters like exclamation points in the friendly name.

Keep this screen open and return to the Microsoft Authenticator App on your mobile device that you installed in step 1.

11. In the Microsoft Authenticator mobile app, click on the “+” and choose Other.

12. If prompted, click Scan QR Code and Allow camera access for the Authenticator app.

13. Point your mobile device camera at your computer browser screen to capture the QR Code that is displayed. When successful you will see a new entry added to the Microsoft Authenticator App displaying a 6 digit code and the same Friendly name you entered earlier.

14. Return to your computer web browser and click the Verify Now button. (A new input section will appear to enter the six digit verification code displayed in Microsoft Authenticator)

15. Enter the 6 digit code in the space provided for your Verification Code then click Verify and Save.
    
    IMPORTANT: You must click Verify and Save to complete the setup process!

Note: New 6-digit verification codes are randomly generated every 30 seconds.

16. You should be automatically redirected to the CUNY My Authentication Factors page and will see a your new Mobile Authenticator – TOTP app now enabled with your friendly name.

Congratulations! Your CUNY Login MFA is ready to go!

IMPORTANT: DO NOT UNINSTALL THE AUTHENTICATOR APP AFTER COMPLETING THIS SETUP!! You will need to enter the code from your authenticator app every time you sign in with your CUNY Login!

When you sign in to CUNY applications that require CUNY Login you will be redirected to a page asking you to enter an OTP code. Open the Microsoft Authenticator app on your mobile device and enter the six-digit code. See How to respond to CUNY Login MFA requests and prompts for more information.

2. Enter your CUNY Login username or EMPLID

3. Enter your answers to two of the five security questions. These are the questions you submitted when claiming your CUNYfirst account.

4. Enter a new password and confirm.

Note: Your password must be between 13 characters and 20 characters long, and include at least one or more uppercase letters, one or more lowercase letters, one or more numeric or special characters, and must not match or contain your CUNY Login username.

What is my CUNY Login username?

Your CUNY Login account username will be in the format Firstname.Lastname##@login.cuny.edu, where ## is the last 2 digits of your CUNY EMPLID. If you are a guest user, your CUNY Login account username will be the one you set in the CUNY Portal.

I forgot my CUNY Login password

Go to managelogin.cuny.edu and click Forgot Your Password. Learn more.

I forgot my CUNY Login username?

Go to managelogin.cuny.edu and click Forgot Your CUNY Login?

I am locked out of my CUNY Login

For security reasons, your CUNY Login is locked for 15 minutes after five failed sign-in attempts. Consider using the Forgot Password option after the fourth failed attempt.

How often do I need to change my CUNY Login password?

You are required to change your CUNY Login password every 180 days, as specified in the CUNY Password Standard.

Where can I learn more about CUNY Login?

Visit the complete CUNY Login FAQ for more information.

I need help with my CUNY Login

Contact the IT Helpdesk

Review the full CUNY Login FAQ