[Campus Notice] Action Required: Multi-Factor Authentication is Coming to UCR Email Resources

[UCR Information Technology Solutions]

Key Takeaways:

   -

   Beginning December 2024, multi-factor authentication (MFA) will be
   required on an ORG unit email account you own/manage to help ensure UCR
   meets new UC information security requirements
   <https://its.ucr.edu/cybersecurity-mandate-2025> by the deadline, as
   mandated by the UC President.
   -

   Anyone who accesses your ORG’s shared email account will be required to
   authenticate their login via MFA, similar to how you access your individual
   UCR email account.
   -

   If you use the ORG unit email account to log into any other services
   (e.g., Zoom), please note that you will be required to authenticate via MFA
   after the change.
   -

   The owner of the ORG unit email account must take action now to ensure
   the account can continue to be accessed come December 2024. Additional
   action may be required of other account users depending on the option
   selected.


Dear Highlander,

You are receiving this notification because you were identified as an owner
or manager of an organizational (ORG) email account at UC Riverside. In
direct response to the UC Cybersecurity Mandate
<https://its.ucr.edu/cybersecurity-mandate-2025>, UCR is further securing
its email resources by implementing multi-factor authentication (MFA) on
all accounts, including ORG email accounts. This change will commence the
first week of December.
Action is Required

In order to continue to access your ORG unit email account come December, the
account owner should take action now to make the account compliant. There
are two options for compliance:


   -

   Option One: Turn your ORG unit email account into a shared department
   email. Instead of a singular email account that has one set of password
   credentials that is shared among team members, a shared email account
   allows for access delegation so that each team member can use their own
   individual credentials to access the mailbox.
   -

      Considerations: The benefit of this option is that the team will not
      need to register multiple devices with the account to access it. The
      disadvantage of this option is that it will not work if your
team uses the
      account to log into MFA-protected services like Zoom or Google Drive.
      -

      To select this option, fill out the request form
      <https://ucrsupport.service-now.com/ucr_portal?id=sc_cat_item&sys_id=b98274261bfe6810609f86e9cd4bcbfd>.
      Under “type of request,” select either Office 365 or R’Mail, depending on
      the email platform you are currently using. Please note in the
description
      that this is to bring the account into MFA compliance.
      -

   Option Two: Set up MFA for your ORG’s shared email account. With this
   option, those with the account credentials will continue to use those
   credentials, however, upon login they will be routed to the Duo page and
   asked to select a device for the MFA verification. This requires each user
   of the account to have a device connected to the account.
   -

      Considerations: This option should be selected by any teams that
      require the ability to use the ORG unit account to log into MFA-protected
      services like Zoom or Google Drive (rather than using their
individual UCR
      accounts). The disadvantage of this option is that every person who needs
      to access this account must register a device with the account
or else they
      will have no means of authenticating.
      -

      To select this option, the account owner must submit a ticket
      <https://its.ucr.edu/help> to request MFA be set up for their ORG’s
      email account. After MFA is enabled, each team member who accesses the
      account must register a device.


If you believe you have received this email by mistake because your ORG
unit’s email account is already enrolled in MFA, please disregard this
message.

We appreciate your partnership as UCR strengthens its information security.
Implementation of robust MFA on all accounts is one of the key steps in
UCR’s security plan to meet the new UC-wide cybersecurity requirements. To
learn more about these requirements and the role you play in helping us
better protect our campus, please visit the UC Cybersecurity Mandate 2025
webpage <https://its.ucr.edu/cybersecurity-mandate-2025>.


Sincerely,

Dewight F. Kramer

Chief Information Security Officer

Sureyya Tuncel

Identity and Access Management Manager





This email account is not monitored by ITS staff. If you require technical
support, please take one of the following actions:


   - Visit the ITS website at its.ucr.edu to find self-help articles,
   submit and track support tickets, request IT services, and more.
   - For live support, you can contact the BearHelp helpdesk at
   951-827-4848 from Monday to Friday, 8:00am to 5:00pm.
   - If you suspect you received a phishing email, please report it using
   PhishAlarm <https://its.ucr.edu/phishalarm>.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ucr.edu/pipermail/tech-bulletin/attachments/20241101/ee4797c7/attachment-0001.html>