Executive Vice President in charge of Information
Takumi MORIYAMA
To all UTokyo Account users,
Thank you for your continued cooperation in the proper use of information systems. At the University of Tokyo, we are committed to creating an environment where all members can conveniently and securely utilize information systems using UTokyo Account. As part of this effort, we are going to make multi-factor authentication (MFA) mandatory for UTokyo Account. This is a policy that further strengthens the information security of our university, following an earlier announcement to faculty and staff “Achieving 100% Multi-factor Authentication Adoption for UTokyo Accounts” (faculty and staff only).
Many of you may already be familiar with MFA, a method of authentication that requires, in addition to a password, an additional verification such as Short Message Service (SMS) or a dedicated app when signing in to an account. By MFA, the risk of unauthorized access to an account can be significantly reduced, withstanding attacks even if the password is compromised. As methods of attacking accounts become increasingly sophisticated, relying solely on passwords for account protection is no longer sufficient.
The information systems at the University of Tokyo handle a wide range of information, including many that are confidential or critical. In today’s rapidly advancing information society, it is crucial to recognize the need to protect this information. Therefore, safeguarding the security of UTokyo Account, which serves as the gateway to various information systems, is essential to protect the valuable information held by members of the University of Tokyo. Please bear in mind that an account of a single individual lacking sufficient security can endanger or damage not only the account holder but also other users. In fact, various incidents resulting from inadequate account security occur in businesses, universities, and other organizations worldwide. No wonder, the next major incident could occur at the University of Tokyo.
Against this backdrop, we will progressively require everyone with a UTokyo Account to use MFA. We have already been requiring faculty and staff to reach a 100% adoption rate of MFA since June 2023. Following this, we will also ask students to do the same. To that end, please recognize the importance of MFA, and if you have not already done so, complete the initial setup for MFA and start using it now. For instructions, please refer to the page “Using Multi-Factor Authentication in UTokyo Account.” If you need help or have questions, see the “Need Help?” section on this page.
Schedule/steps toward Enforcing MFA
We will gradually enforce MFA toward the end of making it mandatory for every UTokyo Account user. Specifically, we will incrementally increase the number of information systems that require MFA. The detailed schedule is as follows:
- Step 1: As of February 2024, MFA is already required for UTokyo VPN and UTokyo Slack.
- Step 2: Starting March 1, 2024, MFA is required for accessing “UTokyo Wi-Fi Account Menu,” the page used for issuing your UTokyo Wi-Fi account.
Step 3: In the next stage, almost all information systems except for UTAS and the new learning management system “UTokyo LMS (UTOL)” will require MFA. We are planning to do it around May 2024, but the exact schedule will be determined by assessing the situation carefully, particularly regarding the progress on student usage, to ensure smooth transition.Specifically, among the information systems marked with ”○” in the UTokyo Account Service Directory, all systems except for UTAS and UTOL will be subject to this requirement. Please note that ECCS Cloud Email (Google Workspace) is also included in this category following the system changes implemented on February 20.
Step 4: Finally, UTAS and UTOL will also require MFA. It will happen around June 2024, but again, the exact schedule will be determined by assessing the progress to ensure smooth transition.- Updated in August 2024: Although we had planned to take action around May-June 2024 to disable almost all information systems, including the academic affairs system “UTAS” and the learning management system “UTOL”, for those who do not use multi-factor authentication, we have decided not to do so at this time. However, we still recognize that the use of multi-factor authentication is mandatory for all UTokyo Account users.
- Additionally, other information systems that do not currently support MFA for UTokyo Account (indicated by ”×” in the UTokyo Account Service Directory) will strictly require MFA when they become MFA-ready. And the same applies when a new information system is introduced in the future.
Need Help?
If you do not have the necessary equipment for MFA (such as a mobile phone), we may be able to lend you a dedicated MFA device.
- If you are a faculty/staff who has a staff ID card with an IC chip, please refer to the UTokyo Portal guidance page (for faculty and staff only) and submit an application.
- If you are a faculty/staff but do not have a staff ID card with an IC chip, please consult the section of your department/school responsible for UTokyo Account (Human Resource personnel) and ask them to apply on your behalf.
- Students may ask for help via the email form of the utelecon support desk.
For any other questions or concerns, please contact the email form of the utelecon support desk.
Additional Notes
- Our authentication system is undergoing changes to accommodate more MFA options. See “System Changes to the Authentication Infrastructure of UTokyo Account” for details.
- To obtain a UTokyo Wi-Fi account, you also need to pass the information security test. See “About using UTokyo Wi-Fi accounts for AY 2024” for more details
- See also the earlier announcement for faculty and staff “Achieving 100% Multi-factor Authentication Adoption for UTokyo Accounts” (faculty and staff only) by the Executive Vice President in charge of Information Systems (CIO).
Update History
- 2024-02-28 English version is published.
- 2024-08-29 Revised.