Skip to content

University accounts

SSO

The University of Oxford computer ID system, commonly referred to as SSO (Single Sign On) is based on Microsoft Entra. Several facilities that OxCIN provide are authenticated using this for example:

  • FMRIB VPN
  • Calpendo.fmrib.ox.ac.uk
  • register.fmrib.ox.ac.uk

SSO accounts require a second 'factor', to confirm your identity, this typically takes the form of something you know and something you have. The most likely combinations are:

  • passkey on a device (laptop/smart phone/Yubikey)
  • passkey in Microsoft Authenticator
  • password + push notification app (e.g. Microsoft Authenticator on a smart device)
  • password + time based one time code

SMS messages are often used for non-University services, but these are now considered insecure so are being phased out for University users adn you should aim to stop using these ASAP.

You can manage these options at https://mysignins.microsoft.com/security-info.

Passkeys

For details on the advantages to passkeys see our password advice page.

Synced passkeys

If you use a password manager (e.g. 1Password, Apple/Google passwords) then it is possible to store the passkey within the password manager and have it available on all devices. This is considered less secure and at present the University has not approved this mechanism, and may indeed prevent them being created (correct in October 2026). This stance may change in the near future. For details on password managers see our password advice page.

Passkeys with remote access sessions

If you need to log into a service through a remote desktop session you obviously cannot use passkeys (unless the desktop environment also has a compatible password manager and a synced passkey). If you are likely to need this capability then you should ensure you have a fall back method, e.g. password + push to Authenticator or password + time based one time code.

Multiple Microsoft accounts

If you have additional Microsoft accounts for other non-University services, e.g. Trusted Research Environments, other University affiliation then the single sign-on nature causes complications. You visit the other service, it detects that you are signed in to a Microsoft account already and attempts to access the service using this account.

In this scenario you need to ensure that you access the different services through different browser sessions. This can be achieved through one of the following methods.

Browser Profiles/Containers

Safari, Firefox and Chrome support isolated profiles (containers on Firefox). These profiles do not share cookies etc and so can be used to sign into these other services. You should create a profile for every distinct service using a Microsoft (or indeed any other federated login, such as a Google login).

Private windows

For a one-off or rarely visited service, a private window will achieve the same.

Different web browser

You could also choose to use one service group in Firefox, the other in Chrome. This may have other advantages if one particular site works better in a particular web browser.

Remote Access

The University remote access accounts are primarily used for connecting to Eduroam on WiFi networks both within Oxford and at educational institutions world-wide. Within FMRIB these accounts are used to log into the ethernet network from your laptop/desktop.

Remote access accounts can be managed at https://register.it.ox.ac.uk.