Managing Multi-Factor Authentication (MFA) During Digital Exams

Multi-factor authentication (MFA) is the process of confirming a person’s identity using multiple verification factors when accessing systems. Starting in May 2026, MFA will be available to students for key academic applications such as Google Suite and Canvas. While MFA was initially introduced to students voluntarily, it will become mandatory by September 2026, requiring students to authenticate through Duo Mobile. This guide provides strategies to minimize disruption and anxiety during the digital exams or exams which require digital resources.

PREPARATION: SETTING YOUR STUDENTS UP FOR EXAM SUCCESS

Successfully managing MFA begins with clear communication to your students before the exam date. 

Logistics and Expectations

The logistics and expectations of your exam may differ depending on where and how it is hosted. 

Scenario #1: In-Person Digital Exams in University Computer Labs

  • Clearly state where the exam is located, especially if it is in a different location from the usual classroom.
  • Remind your students to arrive early to the exam so they can log in to the computer and any required applications or platforms, and begin writing as soon as the testing period begins. This will also help identify issues early. 
  • Detail what students are allowed to have on their person (e.g., water bottle, pencil, student ID, what they must bring to access the exam (e.g., cell phone or Duo fob) and what must be stored away once the exam starts (e.g., cell phones, backpacks, personal devices).

Scenario #2: In-Person Digital Exams Using Personal Devices

  • Clearly state where the exam is located, especially if it is in a different location from the usual classroom.
  • Remind your students to arrive early to the exam so they have time to open any required applications or platforms and begin writing as soon as the testing period begins. This will also help identify issues early. 
  • Detail what students are allowed to have on their person (e.g., water bottle, pencil, student ID, what they must bring to access the exam (e.g., cell phone or Duo fob) and what must be stored away once the exam starts (e.g., cell phones, backpacks, personal devices).
  • Specify whether students need to download any specific software (e.g., a proctoring application such as Respondus) on their personal devices before arriving.

Scenario #3: Remote Exams Using Personal Devices

  • If the exam is synchronous, remind your students to log in early so they have time to open any required applications or platforms and begin writing as soon as the testing period begins. This will also help identify issues early. 
  • Detail what students are allowed to have on their desk or workspace (e.g., computer or tablet used to complete the exam, student ID, water bottle) and what must be stored away (e.g., phones, headphones, additional monitors or screens, notes). Remind them that they may need to show their desk or workspace or complete a brief room scan using the webcam at the start of the exam. 
  • Specify whether students need to download any specific software (e.g., a proctoring application such as Respondus) on their personal devices before arriving.

MFA and Academic Integrity

Talk to your students about why MFA is necessary for their security. For example:

“Multiple authentication matters for accessing the LMS because it helps protect your identity and personal information. Your LMS stores grades, assignments, and course materials. If someone gains access to your account, they could misuse or delete your work. By requiring a second verification step, such as a code or app confirmation, multi-factor authentication ensures that only you can log in. It keeps your coursework, data, and the entire learning system more secure for everyone.”

MINIMIZING STUDENT ANXIETY AROUND MFA DURING EXAMS

The most critical step is managing phones after authentication to maintain exam integrity while minimizing student anxiety. 

Some options for device placement might include:

  • Phone on desk, face down: Instruct students to turn their phones off and place them face down and out of view (e.g., behind the screen of their laptops). Quickly walk around the room to verify student devices are present and inactive. 
  • Put phone away: Ask your students to place the phone used to authenticate into a pocket of a sweater or jacket and hang the item on the back of their chair. 
    • Note: Ensure students are explicitly told not to take their jacket or sweater with them if they leave the room for any reason (e.g., washroom break)
  • Ziploc bag method: Ask students to bring a clear plastic bag, such as a Ziploc, and have students seal their devices in the bag after authentication. The device is then stored face down and out of view. 
    • Note: Be sure to bring extra bags in a variety of sizes to accommodate students who forget their bags or use a larger device, such as a tablet, to authenticate. 
  • Alternate devices: Smart watches used for authentication must be placed face down in the corner of the desk immediately after authentication. Be aware of other emerging wearable devices, such as Meta glasses. 

Although collecting phones in a central basket or location could help prevent cheating, it also creates a liability risk for you and your department.

DURING THE EXAM

At the start of the exam, remind students of all previously discussed expectations. 

  • Create a simple slide with instructions to display on the classroom projector as students arrive.
  • Verbally review the device policy and MFA protocol; do not assume students have read the instructions. 

Immediately after the exam begins, do a quick walk around the room to troubleshoot any initial problems or MFA issues, and to verify that student devices are present and inactive. 

EMERGENCY AND CONTINGENCY STRATEGIES

Prepare a plan for forgotten devices or technical failures. 

  • In the event of an emergency, such as unexpected MFA prompts, software issues, or an unresponsive Duo Mobile app, advise students to raise their hand and request assistance. They should not retrieve their device and try to troubleshoot on their own. 
  • Have the IT Service Desk number (780-492-8000) ready on your desk. If students cannot access their device, have forgotten their device, or Duo Mobile is unresponsive, call the IT Service Desk for immediate assistance with a temporary bypass code or other support. 
  • Have some paper copies of the exam ready as a last-resort backup in case of technical issues or if devices are forgotten. 
    • If your digital exam includes randomized questions, print a few versions to maintain integrity. Consult this guide on how to print quiz versions, as a different version is typically printed each time.

What if a student forgets their phone?

If a student forgets their device, call IST for immediate assistance with a bypass code or ask students to write using one of your paper copies. 

Learn more: Additional resources