Admitted Students

Password Create Instructions

• Create your universal password by going to https://passwordreset.microsoftonline.com
  • Enter your Drury email address (found in your acceptance packet) in the email or username field and click Next.
  • On the next page, select “I forgot my password” option and click Next.
  • Select your verification method:
    • Click Email and verify your alternate email (must match the one provided to Drury when applying)
    • Click Text on the “text my mobile phone” option.
• Enter the verification number, sent either to your personal email or your mobile phone. Click Next.
• On the following page, enter your new password. 

Pasword Requirements

1. Minimum Length. All passwords must be a minimum of 16 characters in length. There is no maximum length restriction; longer passwords and passphrases are strongly encouraged.
2. Character Types. No specific character-type complexity is required. Users may use any combination of the following:
   1. Lowercase letters (a–z);
   2. Uppercase letters (A–Z);
   3. Digits (0–9);
   4. Punctuation and special characters (e.g., ! @ # $ % ^ & *); and
   5. Spaces and Unicode characters.

3. Prohibited Passwords. The following passwords are not permitted regardless of length:
   1. Passwords known or confirmed to have been compromised; and
   2. Passwords containing the user’s name, username, or Drury ID number.
4. Password Reuse. Users may not reuse a recent previous password when setting a new one. The number of prior passwords retained for this purpose is configured and maintained by Technology Services.
5. Rate Limiting and Account Lockout. To protect against brute-force and password-guessing attacks, university authentication systems enforce rate-limiting and temporary account lockout after a defined number of consecutive failed login attempts. The specific thresholds and lockout durations are configured and maintained by Technology Services consistent with current security standards.

Password Expiration

1. Passwords do not expire on a scheduled basis. Mandatory periodic rotation is eliminated consistent with NIST SP 800-63B Rev. 4, which explicitly prohibits scheduled expiration on the grounds that forced rotation leads users to choose weaker, predictable passwords.
2. A password change is required only under the following circumstances:
   1. The account is confirmed or suspected to have been compromised or is identified in a known data breach;
   2. Technology Services notifies the user that their password is known or suspected to be compromised;
   3. A security incident response requires credential rotation; or
   4. The user proactively requests a change.
3. System-level and service account passwords are subject to additional rotation requirements as described in Section 6.
4. The university employs managed detection and response (MDR) and security monitoring services that identify credentials known or suspected to have been compromised, including those exposed in third-party data breaches. When a user’s credentials are identified through these services, Technology Services will require the user to change their password promptly and may disable the account until the password is reset.

Email

To access your email login to outlook.office.com with your Drury email address and the new password you created.

OneLogin

Login to drury.onelogin.com (https://drury.onelogin.com)

Setup Multifactor authentication (help guide is available on my.drury.edu)