[OPLINTECH] Microsoft Office 365 Authentication Changes

[Chad Neeper]

Ken,
I was hoping to address your "two YubiKeys per staff member" issue by
leveraging the Temporary Access Pass (TAP) authentication method. This
allows a user admin to issue a temporary TAP that a user can use to (1) log
into their account and (2) change their authentication methods. This way,
the user retains a backdoor into their account if they lose their
smartphone/YubiKey, but the library doesn't need to buy two for every staff
member. You can buy just one for each and a small handful of unassigned
spares that can be used only as needed. The theory seems reasonable; yet to
be determined in practice.

Chad
______________________________
*Chad Neeper*
Senior Systems Engineer

*Level 9 Networks*
740-548-8070 (voice)
866-214-6607 (fax)

*Full IT/Computer consulting services -- Specialized in public libraries*


On Fri, Aug 28, 2026 at 11:07 AM Kenneth Butler via OPLINTECH <
oplintech at lists.oplin.org> wrote:

> I have been testing FIDO2 security keys (YubiKeys) with our administrative
> accounts, and they have worked very well. Once the keys are enrolled and
> configured, authentication is straightforward: plug in the key, enter the
> PIN when/if prompted, and touch the key.
> I am planning to roll them out to all of our staff. Our current plan is to
> purchase two keys for each employee: a primary key for daily use and a
> backup key that remains locked in a secure location. The backup would only
> be used if the primary key is lost, damaged, or otherwise unavailable.
> The biggest downside is cost. The YubiKeys we are considering are $58
> each. Less expensive models support FIDO2 authentication alone, but we are
> purchasing models that support both FIDO2/WebAuthn and OTP/TOTP. This means
> they're not limited to Microsoft 365 and can also be used to secure vendor
> accounts that support TOTP but not FIDO2.
> The other challenge is initial enrollment. Registering the keys through
> Microsoft 365’s web interface is not especially intuitive, so I expect to
> provide individual, hands-on assistance to each staff member during the
> rollout. Once we have the process established, however, enrolling keys
> should be fairly easy to incorporate into our normal onboarding process for
> new employees.
>
> Ken Butler
> hcotech at holmeslib.org
> Head of Information Technology
> Holmes County District Public Library
> 3102 Glen Drive
> Millersburg, OH 44654
> PH: 330-674-5972 ext 224
>
> ------------------------------
> *From:* OPLINTECH <oplintech-bounces at lists.oplin.org> on behalf of Fred
> Miller Jr via OPLINTECH <oplintech at lists.oplin.org>
> *Sent:* Thursday, August 27, 2026 11:45 AM
> *To:* oplintech at lists.oplin.org <oplintech at lists.oplin.org>
> *Subject:* [OPLINTECH] Microsoft Office 365 Authentication Changes
>
>
> If your library system is using Microsoft Office 365, I would like to hear
> what some of the libraries around the state are doing regarding changes
> coming down from Microsoft Office 365 since they are doing away with
> SMS/Voice authentication in February 2027. I know there are a few
> alternative authentication methods out there to use, but would like to get
> some feedback from other libraries on what method they prefer and the
> pros/cons to using that authentication method.
>
>
>
> Thanks in advance,
>
>
>
> [image: Logo Resized]
>
> *203 Perry Street Wapakoneta, OH 45895*
>
>
>
> *Fred Miller Jr*
>
> IT Service Manager
>
> *T*: *419-738-1215* |* E*: *fmiller at auglaizelibraries.org
> <fmiller at auglaizelibraries.org>*
>
>
>
>
> _______________________________________________
> OPLINTECH mailing list
> OPLINTECH at lists.oplin.org
> https://lists.oplin.org/mailman/listinfo/oplintech
>
> ****** Read about the new cybersecurity policy requirements for libraries
> Learn more at
> https://www.oplin.ohio.gov/security ******
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.oplin.org/pipermail/oplintech/attachments/20260828/77f18979/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.jpg
Type: image/jpeg
Size: 7497 bytes
Desc: not available
URL: <http://lists.oplin.org/pipermail/oplintech/attachments/20260828/77f18979/attachment.jpg>