Duo Multi-Factor Authentication

1. On your mobile device, launch the App Store or Play Store and search for “Duo Mobile.”
2. Tap Get or Install next to Duo Mobile (by Duo Security LLC) to download the app.
3. On your computer, visit any Duo-protected webpage, such as Brightspace or Outlook on the web, and sign in with your NetID.
4. Click Get Started.
5. When prompted to add a device, click Duo Mobile.
   
6. Enter your phone number, check the box () to agree to the terms, and click Continue.
   
7. Verify the number matches what you entered, and then click Yes, it’s correct.
   
8. Since you already installed the Duo app on your phone, click Next.
9. The page will now display a QR code.
10. Open the Duo Mobile app on your phone and follow the prompts to add an account using a QR code.
11. Use your phone to scan the QR code on your computer screen.
12. Your device should now be successfully enrolled as a Duo device. Click Continue to complete setup.

1. On your tablet, launch the App Store or Play Store and search for “Duo Mobile.”
2. Tap Get or Install next to Duo Mobile (by Duo Security LLC) to download the app.
3. On your computer, visit any Duo-protected webpage, such as Brightspace or Outlook on the web, and sign in with your NetID.
4. Click Get Started.
5. When prompted to add a device, click Duo Mobile.
   
6. Click I have a tablet.
7. Since you already installed the Duo app on your device, click Next.
8. The page will now display a QR code.
9. Open the Duo Mobile app on your tablet and follow the prompts to add an account using a QR code.
10. Use your tablet to scan the QR code on your computer screen.
11. Your device should now be successfully enrolled as a Duo device. Click Continue to complete setup.

These steps meant for students or other users who have provided their own security key and do not own a smart device. If you are an employee, you may request a YubiKey instead.

1. On your computer, visit any Duo-protected webpage, such as Brightspace or Outlook on the web, and sign in with your NetID.
2. Click Get Started.
3. When prompted to add a device, click Security key.
4. Click Continue.
   
5. Insert your security key into a USB port on your computer, and press the button, contact point, or contact points to send a one-time-passcode.
6. Your hardware key should now be successfully enrolled as a Duo device. Click Continue to complete setup.

If you’ve already enrolled a device in Duo, the process for enrolling further devices changes. You can also use these instructions to add your phone to a departmental account even if it’s already protecting your personal account.

1. Visit https://uvm.login.duosecurity.com/devices and log in with the account you’d like to add a device to.
2. Click the Add a device button to create a new device listing.
3. Select the type of device you’d like to add: Duo Mobile for a phone or tablet, or Security Key for a YubiKey or other USB hardware key.
   

   

Phone

1. Enter your phone number, check the box () to agree to the terms, and click Continue.
   
2. Verify the number matches what you entered, and then click Yes, it’s correct.
   
3. Since you already installed the Duo app on your phone, click Next.
4. The page will now display a QR code.
5. Open the Duo Mobile app on your phone and follow the prompts to add an account using a QR code.
6. Use your phone to scan the QR code on your computer screen.
7. Your device should now be successfully enrolled as a Duo device. Click Continue to complete setup.

Tablet

1. Click I have a tablet.
2. Since you already installed the Duo app on your device, click Next.
3. The page will now display a QR code.
4. Open the Duo Mobile app on your tablet and follow the prompts to add an account using a QR code.
5. Use your tablet to scan the QR code on your computer screen.
6. Your device should now be successfully enrolled as a Duo device. Click Continue to complete setup.

Hardware Key

1. Click Continue.
   
2. Insert your security key into a USB port on your computer, and press the button, contact point or contact points to send a one-time-passcode.
3. Your hardware key should now be successfully enrolled as a Duo device. Click Continue to complete setup.

Windows Hello / Touch ID / Password Manager

This authentication method is not supported at this time. Please use a Duo Mobile compatible device or a Security Key instead.

Certain actions, such as getting a new phone or a new SIM card, may deactivate your Duo Mobile app. This is because the app will see the phone as an unrecognized device, even if the phone number hasn’t changed. If you have enabled Duo backups on your device, reactivating it later will be much easier (or even automatic).

For instructions on enabling backups, restoring the app from these backups, or otherwise reactivating Duo, please refer to our Reactivating the Duo Mobile App article.

1. Enter your UVM NetID and password as normal, and then click LOG IN.
2. Duo will send a (no-cost) push notification on your device.
3. Open the Duo Mobile app on your device and tap Approve.
4. If you’re the only person who uses this computer, click Yes, this is my device, and Duo will remember you for 7 days. Otherwise, select No.

1. Enter your UVM NetID and password as normal, and then click LOG IN.
2. Open the Duo Mobile app on your smartphone or tablet, find the University of Vermont account, and tap on it to reveal a 6-digit Passcode.
   
3. Click Other options on the computer.
4. Click Duo Mobile passcode.
   
5. Enter the 6-digit passcode revealed previously in the Passcode field, and click Verify.

A YubiKey is a small, USB flash drive-like device that can be worn on a key ring. When it’s plugged into your computer, you can press the button on the YubiKey to gain access to a Duo protected service.

To request a YubiKey, contact Identity and Account Management by emailing iam@uvm.edu and specify whether the new YubiKey should be USB-A or USB-C. There is a one-time fee to your department of $50 for each YubiKey, to be paid for by Chartstring.

Students are not eligible for a UVM-provided YubiKey at this time, but if you are interested, you are encouraged to submit a Footprints request so we know there is interest. You may also provide your own FIDO2 security key and enroll it using the self-service instructions found above.

1. Enter your UVM NetID and password as normal, and then click LOG IN.
2. Click Other options on the computer.
3. Select YubiKey passcode.
4. Insert your YubiKey or security key into a USB port, and then touch the brass contact(s).
   
5. Your device will automatically enter a passcode and log you in.

Offline passcodes should be used as a backup method when you need to provide an additional authentication factor but are unable to use other methods (i.e. no cell service, your device’s battery is fully discharged, etc).

1. Visit https://account.uvm.edu/multifactor and log in with your UVM NetID and password, if prompted.
2. Click Activate/Manage Duo Security.
   Already have a device enrolled in Duo?

   If you’ve previously enrolled a device in Duo, you may receive a prompt asking you to use your currently enrolled MFA device(s) to access this page. If none of your second-factor methods are available, please contact the UVM Tech Team.

3. Click Generate Offline Codes.
4. Print out the list of generated codes and keep it in a safe place.

1. Enter your UVM NetID and password as normal, and then click LOG IN.
2. Click Other options.
3. Click Bypass code.
4. Enter an offline code, and click Verify.
   Offline codes are good for one use only

   You may want to cross out offline codes that you’ve used so that you know which ones are still available.

The following steps will guide you through enrolling your flip phone or landline in Duo Security for SMS and phone call authentication.

1. Visit https://uvm.login.duosecurity.com/devices and log in with your UVM NetID and password, if prompted.
   Already have a device enrolled in Duo?

   If you’ve previously enrolled a device in Duo, you may receive a prompt asking you to use your current MFA device(s) to access this page. If none of the suggested methods work, please contact the UVM Tech Team.

2. Click Add a device.
3. Select Phone number as the device type.
   
4. Enter your Phone number. If this is a landline phone, check the corresponding box.
   
5. Check the box to agree to the terms and then click Continue.
   
6. If you selected landline phone, you’ll be given the opportunity to enter an Extension. If your phone number has no extension, click Skip this step.
   
7. Verify the number matches what you entered, and then click Yes, it’s correct.
   
8. Click Continue. Your phone should now be enrolled.

1. Enter your UVM NetID and password as normal, and then click LOG IN.
   
2. Click Other options.
3. Click Text message passcode.
4. You will receive an SMS text message with a list of codes.
   Not receiving the codes?

   If it has been more than a minute and you still have not received a text with your SMS passcodes, please ensure you have good cell service and can otherwise receive text messages.
   Avoid clicking the Text option again – this will generate a new set of passcodes, rendering previous passcodes invalid.

   
   
   

   Codes can only be used once

   You will receive 10 SMS passcodes separated by spaces. Please keep track of which codes you have used – they can only be used once each.

5. Enter one of the codes into the Passcode field, and click Verify.

1. Enter your UVM NetID and password as normal, and then click Log in.
   
2. Click Other options on the computer.
3. Click Phone call under the appropriate device.
4. Answer the call on your selected device, and then approve the login request by pressing any key on the phone’s number pad.

Multi-factor authentication provides an extra layer of security when accessing sensitive data.

It is designed to thwart stolen login credentials from being used to gain access to protected services, since the thief would not have your second factor.

Yes.

All UVM affiliates are required to use multi-factor authentication to access any protected resource. We have implemented MFA to protect you, your information, and the University’s information.

When enrolling a device in Duo Mobile, you are not able to associate the same phone number with multiple accounts.

To work around this using your tablet or your smartphone, follow the instructions above for enrolling an iPad or Android Tablet. This process presents a QR code that you can scan in your Duo Mobile app.

To log in, you’ll need to use push notifications or Duo Mobile generated codes.

UVM’s authentication page includes a checkbox to “Remember me for 7 days.” You can use this feature when accessing services through a browser to avoid having to use Duo for that service every time you log in.

For most installed apps, like Microsoft Teams or Outlook, you will only have to use Duo again if you supply new credentials (such as after a password change).

Unfortunately, experience has shown that malicious emails can trick even the most savvy users. Every day, members of the UVM community fall prey to phishing scams. Additionally, phishing attempts are not the only methods hackers employ to obtain credentials, and multi-factor authentication is the best protection available against all forms of password compromise.

This option is not currently available.

It depends on which method you use, but it is highly likely that the cost will be effectively none.

• The Duo Mobile app itself is free.
• Generating a code with the Duo Mobile app is free.
• Generating a list of one-time codes from the Multifactor setup page is free.
• If you are connected to Wi-Fi, using the push method is free.
• If you are not on Wi-Fi, the push method uses a very small amount of data, and is still effectively free depending on your cellular data plan.
• Phone calls and SMS may have costs associated depending on your cellular plan.
• A YubiKey or FIDO2 security key comes with a one-time charge of approximately $50.

UVM is requiring multi-factor authentication to solve the problem of stolen, reusable credentials like passwords.

Security questions are no different from passwords in that an attacker who captures your answers to those questions via phishing, other social engineering, or malware can use them to impersonate you. The framework UVM has adopted protects against this in one of two ways:

• by requiring that you have a physical device (smartphone/tablet with Duo Mobile app or security key), or
• by requiring a credential which is only good for a single use (the offline codes method).

If you are an employee, your department can request a YubiKey for you. A YubiKey is a very small device that fits on a key ring and is easy to carry around.

If you are a student, you may provide your own FIDO2 security key and enroll it using the self-service instructions found above.

You may also generate a list of offline codes to keep with you as a backup – they are not recommended as a primary authentication method.

Additionally, you may submit an exemption request from the no telephony policy by filling out the no-telephony exception form.

Yes.

You are encouraged, but not required, to set up Duo on more than one device. This will allow you to still access Duo-protected services if you forget one of your devices at home, and it will make it easier to unenroll a lost or stolen device to prevent others from using it to log in as you.

You may add as many devices as you like on the device management page. After that, when you are logging in you can choose which device Duo will send the authentication request to.

The Duo smartphone app is designed to work internationally – if you install and activate the app before leaving, it can generate the required code even without a mobile voice or data plan, and it can do this anywhere in the world.

If you have a voice or data plan, the app makes multi-factor authentication as easy as a pushing a single button. If you don’t have a voice or data plan, you can use the app to generate a code to be entered manually.

If you’re not receiving texts, enroll your phone as an iPad or Android tablet instead.

After adding your phone, visit the device management page and edit your device to add the phone number.