Duo Security is a Multi-Factor Authentication (MFA) tool used by the University of Vermont to protect sensitive information. Upon logging in to a Duo-protected site or service, you’ll be required to perform an additional authentication step using either the Duo Mobile app or a YubiKey. If you do not have access to your primary device(s), you can use an offline code as a backup option.
There are four device types that you can use to provide the second factor of two-step authentication. Each device has one or more authentication options available. Expand the toggle below to view all supported methods.
Devices and supported authentication methods
Device Type | Authentication Options | Details |
---|---|---|
Smartphone |
|
|
Tablet |
|
|
Hardware Token |
|
|
Backup Access (Offline) Codes |
|
|
Before you can access MFA-protected services, such as PeopleSoft or VMWare Horizon, you must enroll a device.
MFA using the Duo Mobile App
Enroll your Smartphone (First-time Setup)
- On your mobile device, launch the App Store or Play Store and search for “Duo Mobile.”
- Tap Get or Install next to Duo Mobile (by Duo Security LLC) to download the app.
- Visit any Duo protected webpage on your computer, such as Brightspace or Outlook Online, and sign in with your NetID.
- Click Next to advance through the 3 Welcome to Duo prompts.
- When prompted to select an option, click Duo Mobile.
- Enter your phone number and click Add phone number.
- Verify the number matches what you entered, and then click Yes, it’s correct.
- Since you already installed the Duo app on your phone, click Next.
- The page will now display a QR code.
- Open the Duo Mobile app on your phone and follow the prompts to add an account using a QR code.
- Use your phone to scan the QR code on your computer screen.
- Your device should now be successfully enrolled as a Duo device. Click Continue to complete setup.
Enroll your iPad or Android Tablet (First-time Setup)
- Search for the Duo Mobile app in the App Store (iOS) or Google Play Store (Android) and tap Get or Install to download and install it.
- On your computer, visit account.uvm.edu/multifactor and sign in with your NetID.
- Click Next to advance through the 3 Welcome to Duo prompts.
- When prompted to select an option click Duo Mobile.
- Click I have a tablet.
- Since you already installed the Duo app on your device, click Next.
- The page will now display a QR code.
- Open the Duo Mobile app on your tablet and follow the prompts to add an account using a QR code.
- Use your tablet to scan the QR code on your computer screen.
- Your device should now be successfully enrolled as a Duo device. Click Continue to complete setup.
Enroll a Secondary Device
If you’ve already enrolled a device in Duo, the process for enrolling further devices changes. This process will be the same for both phones and tablets, and you can also use these instructions to add your phone to a departmental account even if it’s already protecting your personal account.
- Visit https://account.uvm.edu/multifactor and log in with the account you’d like to add a device to.
- Click Activate/Manage Duo Security, and then proceed through Duo using your primary device if prompted.
- Click the Add device button to create a new device listing.
- Specify the platform of the device and add a nickname, but list the type as “Other/Non-phone” even if the device is a phone. When you are done filling out this information, click Add Device.
- The page will now display a QR code.
- Open the Duo Mobile app on your device and follow the prompts to add an account using a QR code.
- Use your device to scan the QR code on your computer screen.
- Your device should now be successfully enrolled in Duo.
Log in using Push Notifications
- Enter your UVM NetID and password as normal, and then click Login.
- Duo will automatically receive a (no-cost) push notification on your device.
- Open the Duo Mobile app on your device, and then tap Approve.
- If you’re the only person who uses this computer, you can click Yes, this is my device and Duo will remember you for 7 days.
Log in with Duo Mobile Generated Codes
- Enter your UVM NetID and password as normal, and then click Login.
- Open the Duo Mobile app on your smartphone or tablet and find the University of Vermont account.
- Press show to reveal a 6-digit passcode.
- Click Other options on the computer.
- Click Duo Mobile passcode and input the 6-digit passcode in the Passcode field and click Verify.
Need to reactivate your device?
If you get a new phone, you must remove the old device and add the new one. This is because the Duo app will see the two phones as two separate devices, even if they have the same phone number. This could also happen if you get a new SIM card, or for other related reasons.
The process for adding a device is different if you’ve already added your first. For detailed instructions on doing this, please refer to our guide on Reactivating the Duo Mobile App.
MFA using a YubiKey
Request a YubiKey
A YubiKey is a small, USB flash drive-like device that can be worn on a key ring. When it’s plugged into your computer, you can press the button on the YubiKey to gain access to a Duo protected service.
To request a YubiKey, contact Identity and Account Management by emailing iam@uvm.edu and specify whether the new YubiKey should be USB-A or USB-C. There is a one-time fee to your department of $50 for each YubiKey, to be paid for by Chartstring.
Log in using a YubiKey
MFA using Offline Codes
Generate Backup Access (Offline) Codes
Offline passcodes should be used as a backup method when you need to provide an additional authentication factor but are unable to use other methods.
- Visit https://account.uvm.edu/multifactor and enter your UVM NetID and password, if prompted.
- Click Activate/Manage Duo Security.
- Click Generate Offline Codes.
- Print out the list of generated codes and keep it in a safe place.
Off-line passcodes are to be used when you need to provide an additional authentication factor but are unable to use the on-line methods (i.e. no cell service, your device’s battery is fully discharged, etc). You can provide one of the following codes as a one-time substitute for an on-line one-time password. It is highly advised that you make a copy of this list and keep it in a safe location such as in a wallet or purse.
Log in using an Offline Code
MFA using Telephony Options
Add a Non-Smart Phone
The following steps will guide you through enrolling your cell phone in Duo Security for SMS authentication.
- Visit https://account.uvm.edu/multifactor and enter your UVM NetID and password, if prompted.
- Click Activate/Manage Duo Security.
- Click Add Device.
- Select Mobile as the type, choose Unknown for platform, enter your phone number (with area code), enter a nickname for your phone, and then click Add Device.
- Your phone should now be successfully enrolled.
Add a Landline or Office Phone
- Visit https://account.uvm.edu/multifactor and enter your UVM NetID and password, if prompted.
- Click Activate/Manage Duo Security.
- Click Add Device.
- Select Landline as the type, enter your phone number (with area code), your phone extension (if applicable), and a nickname for your phone, and then click Add Device.
- Your phone should now be successfully enrolled.
Log in using Duo SMS Text Messages
Log in using a Phone Call
Frequently Asked Questions
What does Duo do?
Multi-factor authentication provides an extra layer of security when accessing sensitive data.
It is designed to thwart stolen login credentials from being used to gain access to protected services, since the thief would not have your second factor.
Am I required to use multi-factor authentication (MFA), and if so, why?
Yes.
All UVM affiliates are required to use multi-factor authentication to access any protected resource. We have implemented MFA to protect you, your information, and the University’s information.
How do I use Duo with a departmental account?
When enrolling a device in Duo Mobile, you are not able to associate the same phone number with multiple accounts.
To work around this using your tablet or your smartphone, follow the instructions above for enrolling an iPad or Android Tablet. This process presents a QR code that you can scan in your Duo Mobile app.
To log in, you’ll need to use push notifications or Duo Mobile generated codes – telephony options will be unavailable.
Do I have to use Duo every time I log in?
UVM’s authentication page includes a checkbox to “Remember me for 7 days.” You can use this feature when accessing services through a browser to avoid having to use Duo for that service every time you log in.
For most installed apps, like Microsoft Teams or Outlook, you will only have to use Duo again if you supply new credentials (such as after a password change).
I know how to avoid phishing email messages, why do I need to use this?
Unfortunately, experience has shown that people are not as good at recognizing malicious email as you might think. Every day, members of the UVM community fall prey to these kinds of scams.
We have to take steps to ensure that we are each more than just a single click away from having our paychecks stolen or becoming victims of identity theft. There are other ways for hackers to get your credentials besides phishing, and multi-factor authentication is the best protection available against hackers.
Can more than one person register a phone we share?
This option is not currently available. Should UVM find a usage case that requires it without a reasonable alternative, it will be reevaluated.
Will it cost me anything to use multi-factor authentication?
It depends on which method you use, but it is highly likely that the cost will be effectively none.
- The Duo Mobile app itself is free
- Generating a code with the app is free
- If you are connected to Wi-Fi, using the push method is free
- If you are not on Wi-Fi, the push method uses a very small amount of data, and is still effectively free depending on your cellular data plan
- Generating a list of one-time codes from the Multifactor setup page is free
- A YubiKey comes with a one-time charge of approximately $50 to your department, not to you
Can I use security questions instead?
UVM is requiring multi-factor authentication to solve the problem of stolen, reusable credentials like passwords.
Security questions are no different from passwords in that an attacker who captures your answers to those questions via phishing, other social engineering, or malware can use them to impersonate you. The framework UVM has adopted protects against this in one of two ways:
- by requiring that you have a physical device (smartphone/tablet with Duo Mobile app or YubiKey), or
- by requiring a credential which is only good for a single use (the offline codes method).
What if I don’t have a smartphone or tablet?
If you don’t have a smart device, your department can request a YubiKey for you. A YubiKey is a very small device that fits on a key ring and is easy to carry around.
You may also generate a list of offline codes to keep with you as a backup – they are not recommended as a primary authentication method.
Can I set up Duo on more than one device?
Yes.
You are encouraged, but not required, to set up Duo on more than one device. This will allow you to still access Duo-protected services if you forget one of your devices at home, and it will make it easier to unenroll a lost or stolen device to prevent others from using it to log in as you.
You may add as many devices as you like on the Multi-Factor setup page. After that, when you are logging in you can choose which device Duo will send the authentication request to.
Can I use Duo internationally?
If your phone number changes while traveling, telephony options (calls and texts) will likely stop working. However, the Duo smartphone app is designed to work internationally – if you install and activate the app before leaving, it can generate the required code even without a mobile voice or data plan, and it can do this anywhere in the world.
If you have a voice or data plan, the app makes multi-factor authentication as easy as a pushing a single button. If you don’t have a voice or data plan, you can use the app to generate a code to be entered manually.
I'm trying to enroll my phone, but I'm not receiving text messages. What do I do?
If you’re not receiving texts, enroll your phone as an iPad or Android tablet instead.
After adding your phone, visit the device management page and edit your device to add the phone number.