Multi-Factor Authentication

As part of the CALPADS change to a new User Authentication system per CALPADS Flash 319, the system is now implementing Phase 2 of the transition. The system will now employ multi-factor authentication (MFA) to verify a user’s identity during the login process. MFA adds an additional layer of security to protect CALPADS data from unauthorized access.

Implementation Timeline

August 25, 2026: Voluntary activation of MFA by clicking on "Activate MFA" found on CALPADS homepage.

September 15, 2026 (To be finalized): Full functionality will be implemented across the board.

Things to Remember

  1. Once authentication is verified through MFA, a user will enjoy a 24-hour Conditional Access window that will not require re-authentication.

  2. Even if the 24-hour Conditional Access window has not expired, certain user actions or technical events break the trust established by Entra, forcing an immediate MFA prompt. These triggers include:

Explicit Logout:

  • Action: The user clicks "Sign Out" within an enterprise application or the Microsoft 365 portal.
  • Result: Entra revokes the active session tokens on the server side, terminating the 24-hour grace period instantly.

Clearing Browser Cookies and Cache:

  • Action: The user (or an automated script, privacy extension, or browser policy) clears local browser storage, cookies, or site data.
  • Result: Entra session cookies (which prove the user has already satisfied the MFA requirement) are deleted. Without these cookies, Entra cannot validate the existing session and demands a new MFA code.

Changing Browsers or Devices:

  • Action: The user authenticates in Google Chrome, and then attempts to access the resource using Microsoft Edge, Safari, or a different device.
  • Result: Entra session tokens and Primary Refresh Tokens (PRTs) are strictly bound to the specific device and browser profile context. A new browser environment lacks the necessary cryptographic identifiers, triggering a fresh MFA challenge.