Just because the message starts with "IT Department" does not make it official. The below message, while appearing to come from ... who is it coming from? Office365? Microsoft? Tntech? How about none-of-the-above!
While the message tries to be official, it actually is all over the place, which should sound the alarm right away. This message comes from a compromised account, but also has a link that is outside the university. In addition, the lack of official notice should add to the surmounting oddities. Always be careful when urgent requests are made to "verify" your account. We already know who you are!
Please report any suspicious emails to firstname.lastname@example.org