One account gets you into everything we run. This page explains how to set it up, what to expect the first time, and what to do when it goes wrong.
One account, everything
Mail, photos, files, chat, remote desktops — all of it uses the same username and password. There is no separate account per service, and nothing to sign up for individually.
Your credentials are your NCSCAS account. That’s the directory account behind everything; it’s what you type into the login box. If you’re not sure what your username is, ask — don’t guess at it.
NCSMFA is the sign-in page itself, at ncsmfa.northlandcentral.org. You don’t go there directly. You click into whatever service you wanted, and it sends you there to prove who you are before letting you through.
Signing in the first time
1. Go to the service you actually want. Photos, mail, whatever. Don’t start at the NCSMFA login page.
2. You’ll be redirected to ncsmfa.northlandcentral.org. This is normal and it is us. Being bounced to an unfamiliar address during login is exactly the thing you should normally be suspicious of, which is why it’s worth knowing in advance that this particular one is expected. Check the address bar, confirm it says ncsmfa.northlandcentral.org, and carry on.
3. Enter your NCSCAS username and password.
4. Set up two-factor authentication. On your first successful login you’ll be walked through a setup wizard. This isn’t optional and you can’t skip it — your password alone won’t get you in afterward.
5. That’s it. You’re signed in, and every other service will now let you through without asking again for a while.
Picking an authenticator
The wizard will ask you to enroll a second factor. We suggest Cisco Duo — it sends a push notification you approve with one tap, which is the easiest version of this for most people. Any app that supports TOTP will also work.
One thing not to do: don’t store your NCSMFA second factor inside NCSMCS. The password vault sits behind this login. If the code you need to get through NCSMFA lives in the vault, and the vault needs NCSMFA to open, you have built a locked door whose key is inside the room. Keep your second factor on your phone’s authenticator app, separate from the vault.
Whatever you choose, understand what it is: a second lock on the door, on a device that is physically yours. A stolen password is no longer enough to get into your mail, your files, or your photos.
Every time after that
Click the service you want. If you’ve signed in recently, you go straight through. If not, you get the NCSMFA page, your password, and a tap on your phone.
You are not expected to memorize which service lives at which address. That’s what the services page is for.
If you’ve been using the Microsoft login
Your Microsoft 365 sign-in is going away. NCSMFA replaces it.
Same you, same mail, different door. Your address still works, including the old domains, and nothing you’ve received disappears. What changes is the login screen you land on and the app you tap to approve it.
If you land on a Microsoft sign-in page somewhere after the migration, you’ve found something that hasn’t been switched over yet. Tell us where you saw it rather than working around it.
When something goes wrong
Wrong password. The password for NCSMFA is your NCSCAS password. If you’ve forgotten it, email support@ncsmx.org or call (210) 904-8005.
Locked out because you lost your phone, or your second factor is gone. Contact NCS MIS/IT at support@ncsmx.org or (210) 904-8005 and we’ll reset it so you can enroll a new device. Email works from any address, including a personal one, and needs no login at all — which is the point, since you can’t get to the ticket portal either.
Getting a new phone. Move your authenticator before you wipe or trade in the old one. Duo has a process for this; a plain authenticator app does not, and once the old phone is gone, so are the codes. Five minutes of planning here prevents a bad hour later.
Everything seems broken. Check the status page first, then open a ticket at ncshds.northlandcentral.org.
A note on why it works this way
One account is less to remember. Two factors mean a leaked password isn’t a catastrophe. Both of those are ordinary good practice.
The part that’s specific to us: the directory doing the authenticating is ours. Your credentials are checked against a server we own, not handed to a company whose privacy policy is subject to revision. That’s the same reasoning behind everything else here, applied to the front door.
