University of Houston-Downtown / Information Technology / Duo (Two-Factor Authentication)

Duo (Two-Factor Authentication)

Why are we moving to Two Factor Authentication?

Two factor authentication (2FA) is the most effective way to secure our computer accounts and it is easy to use! If you’ve ever received a text message to confirm your identity when you log into an online retailer or banking site, you’ve used 2FA. It allows you to confirm your identity by text message, phone call, mobile application, and other methods.

What is Duo (Two Factor Authentication - 2FA)?

Two Factor Authentication (2FA) is an additional layer of authentication beyond a username and password. 2FA involves something that you know (password) plus something that you have with you (like a cellphone or tablet) to prevent someone from logging in with only your password. With Duo 2FA, you still enter your username and password. The second factor provided by Duo is simply an added layer of security on top of your existing credentials.

Setup Graphic for Duo/ Two Factor Authentication

Two steps are required for successful access:

Something you know (UHD username and password)
Something you have (a Duo-enrolled device/typically a mobile phone)

Device table for duo and what devices can do what

What authentication method is right for me?

Duo Push (Fastest and Easiest!)
Downloading the Duo Mobile App is the fastest way to confirm your identity. You will not be required to type in a code when using this method. (Standard data charges may apply.)
You can download the Duo Mobile App on Android and iOS Devices.

Call Me
Prefer a telephone call? Click Call Me and Duo will call you and ask you to “push any number to proceed.” Remember me for 30 days is an option available for web apps.
If you don't carry a smartphone, Duo can call you on a cell phone or landline
Passcode
Prefer to enter a security code? Click Enter a Passcode then Text me new codes. (Standard text message rates may apply.) Duo will text you a code that you must then enter before clicking Log In. Remember me for 30 days is an option available for web apps.
Hardware Token
Duo supports a standalone, password hardware token for two factor authentication. It is a small device that you carry with you to generate passcodes. It is currently $24 and may be purchased from through the UH Cougarbyte Store. Under Personal Purchases search for Duo Hardware Token.
USB Security Key
Duo supports use of a USB security Key for 2FA authentication. These can be purchased from a number of vendors. Please review the Duo Security Key Guide before purchasing a security key.
Touch ID
Duo supports the Touch ID feature on MacOS.

Visit the Duo portal to make changes to your Duo account

Duo Two Factor Authentication Portal – Login to manage your Duo 2FA settings and devices.

Duo FAQs

Setup Process

What do I do after I enroll?

Login to Office 365 and you will notice that the Duo two factor authentication layer is now in place. (You may need to logout of O365 and then back in after enrollment.) You will be prompted to authenticate using Duo after you login with your username and password.

How can I learn more about Duo Enrollment?

Please visit this Duo Enrollment Guide to learn about enrolling in Duo.

What if I have multiple UHD accounts?

You will enroll all accounts in Duo, but can use the same phone number for all accounts.

Where can I find the Duo mobile app?

Duo mobile for Android devices

Duo mobile for Apple devices

How to set up the Duo App on my smartphone?

All users will get an automated email from Duo Security containing a device registration link. If you receive an email, it is recommended to do the set up on a browser on a computer. You will eventually need to scan a QR code with your phone if you are putting the app on your phone.

When you click on the email registration link the setup process will begin:

Click Start Setup to begin.

Pick what type of device you will be using and click Continue. This guide is focused on mobile phones. For additional guides, please visit Duo Guides.

Enter your phone number and click Continue. A checkbox may appear to verify the phone number entered.

Verify what type of phone (iPhone, Android, Windows Phone, other) you are using and click Continue.

If this is the first time you are enrolling in Duo, and you need to install the app, now is the time. Then click I have Duo Mobile installed.

DUO mobile for Apple devices

Duo mobile for Android devices:

Once installed, scan the QR code given and click Continue.

Duo Enrollment Screenshot

Choose what you want it to do when you log in and click Saved then Finish Enrollment.

Set up is now complete.

If you are logged into any Office365 applications, make sure you log out and log back in again.

Using Duo

What should I expect when I choose the Duo Send Me a Push option?

A login request will be sent to your phone. You may Approve or Deny the login request. (Standard data charges may apply.)
Tap Approve to finish logging in to the Duo-protected application.

Not expecting a Duo push notification?
If you get a login request that you weren't expecting, tap Deny on the notification on the full Push screen to reject the request.
You will be asked a reason why you are denying the push:

It seemed fraudulent rejects the login attempt and also notifies your Two-Factor Authentication administrator about the suspicious request.
It was a mistake denies the request without reporting it.

What should I expect when I choose the Duo Call Me option?

When you are prompted to choose an Authentication method, choose Call Me.
You will receive a phone call asking you to tap any button on your phone. Once you tap the button you will automatically be logged in.

What should I expect when I choose the Duo Enter a Passcode option (Text)?

When you are prompted to choose an Authentication method, choose Enter a Passcode.
At the bottom, you will get a blue box and click on Text me new code. You will receive a text with a temporary passcode that will allow you to login. (Standard text message rates may apply.)
Duo Passcode Screenshot

How do I use the Duo Hardware Token to authenticate?

Refer to the Duo Hardware Token guide for current instructions.

How do I use a Security Key to authenticate?

Refer to the Duo Security Key guide for current instructions. Need help? Contact the IT Service Desk 713-221-8031.

How do I use Touch ID for Duo authentication?

Refer to the Duo Touch ID guide for current instructions. Need help? Contact the IT Service Desk 713-221-8031.

What is a Duo Hardware Token?

Hardware tokens are currently $24.00 to purchase and you may purchase them from the CougarByte Store. Under Personal Purchases search for Duo Hardware Token. Take care to purchase the hardware token specifically for UHD.

To use your hardware token please follow these Duo Hardware Token Guidelines.
Duo Purchase Screenshot

What are Security Keys?

A security key plugs into your USB port and when tapped or when the button is pressed it sends a signed response back to Duo to validate your login. Duo uses the U2F and WebAuthn authentication standards to interact with your security keys. You may also see WebAuthn referred to as "FIDO2".

What are the Security Key Requirements?
In order to use a security key with Duo, make sure you have the following:

A supported browser (Chrome 70, Firefox 60, Safari 13 or later), or Microsoft Edge 79 or later. Support for authentication is limited to web applications that show Duo's inline browser prompt.
An available USB port. Be sure to check whether you have a USB-A (square) or a USB-C (smaller and more rounded)
A supported USB security key. WebAuthn/FIDO2 security keys from Yubico or Feitian are good options. U2F-only security keys (like the Yubikey NEO-n) can't be used with Firefox.

Additionally, your administrator must enable the use of security keys in Duo. Contact the IT Service Desk if you at all uncertain about what to purchase and we can help guide you. 713-221-8031

Can I set Duo to automatically use a particular authentication method?

Yes, to set this up do the following:

Open an incognito window in Chrome
Login to O365. (You will see a Duo window.)
Select My Settings & Devices.
Choose your default device.
In the When I login drop-down select: Automatically send this device a Duo Push.
Click Save.

Can I switch my cell phone or make other changes my DUO account settings?

Visit our Duo Settings Portal to make adjustments to your Duo account. The portal will allow you to :

Add a new device
Modify existing Devices
1. Reactivate Duo mobile - (good when you update your app)
2. Delete
3. Change Name
Change your default device
Set a default authentication method
Access the full Duo Guide
Access the UHD Duo page

The Duo app wants access to my camera. Why?

Camera Access. This permission requires you to explicitly grant permission for Duo Mobile to use your camera during the enrollment process to scan QR codes that are used to quickly add multi-factor authentication accounts. You can deny this permission and enter the code manually and you can remove permission to camera after enrollment is completed. Duo Mobile will never access your photos and will not use your camera without explicit permission. Read more about Duo Mobile permissions.

Common Issues

My device cannot find or install the Duo Mobile App. What can I do?

Your device may be too old or unsupported by Duo. You can still authenticate by phone call, SMS text message, or hardware token.

For additional information on supported versions:
Android Supported Versions
iOS Supported Versions

Why am I not getting my Push notification?

If you have your phone set to Do Not Disturb, this will prevent Push notifications from coming through.

Why is Duo mobile app saying it detected security issues with my device?

Duo may make recommendations on how to better secure your device. Click on the pop-up in your Duo mobile app to see what needs to be updated. These can also be completed at a later time.

About Duo

What is Two Factor Authentication (2FA)?

2FA is an additional layer of authentication beyond a username and password. 2FA involves something you know (password) plus something you have with you (like Duo Mobile on your smartphone) to prevent someone from logging in with only your password. With Duo 2FA, you still enter your username and password. The second factor provided by Duo is simply an added layer of security on top of your existing credentials.

Why are we moving to Two Factor Authentication?

What UHD applications will require Duo authentication?

Duo authentication will be required for Office 365 web apps at this time. Other applications will be announced and added later.

Office 365 web applications include but are not limited to:

Outlook Web Access (OWA)
One Drive
Microsoft Teams

How does Duo protect my privacy?

Please review the Duo Mobile Privacy Information.

How can I learn more about the accessibility features of Duo?

Duo's authentication prompt is fully compatible with popular screen readers and voiceover options on Apple and Android phones. It is most accessible on up-to-date version of the most popular browsers: Chrome, Safari, Firefox, and Edge. The Duo Mobile application for iOS and Android is also compatible with platform native text to speech and alternative navigation options.

Please review the Accessibility and Duo webpage for the most complete and up-to-date information regarding accessibility including best practices and known issues.

Contact The IT Service Desk at 713-221-8031 if you need assistance.

Can I use Duo while traveling internationally?

If you travel internationally, don’t worry – Duo authentication can work without cellular service or a wifi connection. You have several options that may be useful:

Smartphone – Even with cellular service disabled or without a wifi connection, you may use the Duo Mobile app to generate a passcode that you can use to authenticate your account. Simply choose the Enter a Passcode option when you get the Duo authentication prompt.
To generate the passcode, open the Duo Mobile app on your phone and tap the down arrow symbol ∨ next to "University of Houston - Downtown".

Hardware token – if you don’t have a smartphone and you travel internationally often, you may want to get a hardware token (contact the IT Service Desk to start the process).
Simply choose the Enter a Passcode option when you get the Duo authentication prompt and then enter the passcode that shows on the hardware token.

ByPass Code – If you won’t have a smartphone and a hardware token is not an option, it is possible to get a bypass code that you can use for Duo authentication for the duration of your trip. Contact the IT Service Desk to request this option.
Then, simply choose the Enter a Passcode option when you get the Duo authentication prompt and enter the bypass code that you were given.

Normal options – If you have cellular service or a wifi connection, then you can simply use whatever authentication technique you normally use. The push, passcode, and phone call options all work overseas. You can even add an international phone number as one of your authentication options.

Last updated 4/9/2021 9:23 AM