Your Murdoch Password

Your password must be between 8 and 30 characters and include:

• at least one upper case alphabetic character (A-Z)
• at least one lower case alphabetic character (a-z)
• at least one numeral (0–9) or special character (*|+#) but not an ampersand (&) or double quotes (").

Your password must not:

• match any previous passwords
• include any characters occurring more than four times
• include alphabetic or numeric sequences of three or more characters (e.g. abc, 123)
• include keyboard sequences of three or more alphabetic characters (e.g. qwerty)
• include six or more sequential characters from your Murdoch username
• include three or more sequential characters from any part of your name
• include your date of birth.

Create a passphrase

Use symbols and numbers to replace some of the letters, to make a passphrase that is both strong and easy to remember. For example, "gibsonplayauthentic" can be rewritten as "gibs0nplay@uthentic".

Don’t use any of the following, spelled either forwards or backwards:

• names of anybody or anything associated with you (e.g. family, friends, pets)
• numbers associated with you (e.g. birth date or year, phone number, license plate number)
• words found in an English or foreign language dictionary
• place names
• proper nouns

or any of the above followed or preceded by a single numeric character and a single special character.

Don’t share your password or write it down

Your password should remain private. Do not share it with anyone, write it down or store it in an email or text file.

Use a password manager

Install a free, open-source password management tool like KeePass or Bitwarden to help generate, manage and store your passwords securely.

Don’t use 'Remember Password' option

Passwords saved to your computer or browser are a security risk, as they may be accessed by others from your computer or through attacks on outdated browsers.

Change your password frequently

It is recommended that you change your password for critical systems and accounts, including your Murdoch account, every 90 days.

Don't reuse passwords

Cyber criminals can obtain passwords through techniques such as brute force attack and phishing. MFA provides an additional layer of protection by requiring you to verify your identity using your mobile device. This makes it harder for someone to access your Murdoch account, even if they know your password, because they would also need physical possession of your mobile device to complete verification.

MFA is automatically enabled on your MU account. After setting your initial password, follow the relevant MFA Setup Instructions for new students or staff. MFA Setup is simple and can be done at home or on campus.

Update your MFA setup with your new mobile number by following the Updating MFA Setup Guide. If you no longer have access to your previous mobile number, please contact our IT Service Desk for assistance.

From time to time, you will be asked to verify your identity when signing in to a Murdoch system. This verification process is called authentication and confirms that it is really you trying to access your account. Authentication uses number matching, where you enter a verification number to confirm your identity and complete sign-in.

If you are using the Microsoft Authenticator app, please refer to the Verify your identity using the App for guidance on how to authenticate with and without mobile reception. 

Update your MFA details by following the Updating MFA Setup guide.

If you can no longer verify your identity using your previous details, please contact the IT Service Desk for assistance.

You may be asked to verify your identity using MFA before your online exam begins. Your exam invigilator will guide you through this process and any other preparations. Visit the Online Exams page for more information.

Using the Microsoft Authenticator app
Yes. The App does not require mobile reception or internet connection. Please refer to the Verify your identity using the App Guide for instructions.

Using SMS verification code
Unfortunately you cannot authenticate by SMS verification code without mobile reception. We recommend switching to the App so you can verify your identity even when reception is unavailable. Follow the App Setup Instructions to make the switch.