Duo (Two-Factor Authentication)

Login to Office 365 and you will notice that the Duo two factor authentication layer is now in place. (You may need to logout of O365 and then back in after enrollment.) You will be prompted to authenticate using Duo after you login with your username and password.

Please visit this Duo Enrollment Guideto learn about enrolling in Duo.

You will enroll all accounts in Duo, but can use the same phone number for all accounts.

Duo mobile for Android devices

Duo mobile for Apple devices

All users will get an automated email from Duo Security containing a device registration link. If you receive an email, it is recommended to do the set up on a browser on a computer. You will eventually need to scan a QR code with your phone if you are putting the app on your phone.

When you click on the email registration link the setup process will begin:

Click Start Setupto begin.

Pick what type of device you will be using and click Continue. This guide is focused on mobile phones. For additional guides, please visit Duo Guides.

Enter your phone number and click Continue. A checkbox may appear to verify the phone number entered.

Verify what type of phone (iPhone, Android, Windows Phone, other) you are using and click Continue.

If this is the first time you are enrolling in Duo, and you need to install the app, now is the time. Then click I have Duo Mobile installed.

DUO mobile for Apple devices
Duo mobile for Android devices

Once installed, scan the QR code given and click Continue.

Choose what you want it to do when you log in and click Saved then Finish Enrollment.

Set up is now complete.

If you are logged into any Office365 applications, make sure you log out and log back in again.

A login request will be sent to your phone. You may Approve or Deny the login request. (Standard data charges may apply.)
Tap Approve to finish logging in to the Duo-protected application.

Not expecting a Duo push notification?
If you get a login request that you weren't expecting, tap Deny on the notification on the full Push screen to reject the request.

You will be asked a reason why you are denying the push:

• It seemed fraudulent rejects the login attempt and also notifies your Two-Factor Authentication administrator about the suspicious request.
• It was a mistake denies the request without reporting it.

When you are prompted to choose an Authentication method, choose Call Me.
You will receive a phone call asking you to tap any button on your phone. Once you tap the button you will automatically be logged in.

When you are prompted to choose an Authentication method, choose Enter a Passcode.

At the bottom, you will get a blue box and click on Text me new code. You will receive a text with a temporary passcode that will allow you to login. (Standard text message rates may apply.)

Refer to the Duo Hardware Token guidefor current instructions.

Refer to the Duo Security Key guide for current instructions. Need help? Contact the IT Service Desk 713-221-8031.

Refer to the Duo Touch ID guidefor current instructions. Need help? Contact the IT Service Desk 713-221-8031.

Hardware tokens are currently $24.00 to purchase and you may purchase them from the CougarByte Store. Under Personal Purchases search for Duo Hardware Token. Take care to purchase the hardware token specifically for UHD.

To use your hardware token please follow these Duo Hardware Token Guidelines.

A security key plugs into your USB port and when tapped or when the button is pressed it sends a signed response back to Duo to validate your login. Duo uses the U2Fand WebAuthnauthentication standards to interact with your security keys. You may also see WebAuthn referred to as "FIDO2".

What are the Security Key Requirements?
In order to use a security key with Duo, make sure you have the following:

• A supported browser (Chrome 70, Firefox 60, Safari 13 or later), or Microsoft Edge 79 or later. Support for authentication is limited to web applications that show Duo's inline browser prompt.
• An available USB port. Be sure to check whether you have a USB-A (square) or a USB-C (smaller and more rounded)
• A supported USB security key. WebAuthn/FIDO2 security keys from Yubico or Feitian are good options. U2F-only security keys (like the Yubikey NEO-n) can't be used with Firefox.

Additionally, your administrator must enable the use of security keys in Duo. Contact the IT Service Desk if you at all uncertain about what to purchase and we can help guide you: 713-221-8031.

Yes, to set this up do the following:

1. Open an incognito window in Chrome
2. Login to O365. (You will see a Duo window.)
3. Select My Settings & Devices.
4. Choose your default device.
5. In the When I login drop-down select: Automatically send this device a Duo Push.
6. Click Save.

Visit our Duo Settings Portalto make adjustments to your Duo account. The portal will allow you to :

1. Add a new device
2. Modify existing Devices
   1. Reactivate Duo mobile - (good when you update your app)
   2. Delete
   3. Change Name
3. Change your default device
4. Set a default authentication method
5. Access the full Duo Guide
6. Access the UHD Duo page

This permission requires you to explicitly grant permission for Duo Mobile to use your camera during the enrollment process to scan QR codes that are used to quickly add multi-factor authentication accounts. You can deny this permission and enter the code manually and you can remove permission to camera after enrollment is completed. Duo Mobile will never access your photos and will not use your camera without explicit permission. Read more about Duo Mobile permissions.

Your device may be too old or unsupported by Duo. You can still authenticate by phone call, SMS text message, or hardware token.

For additional information on supported versions:
Android Supported Versions
iOS Supported Versions

If you have your phone set to Do Not Disturb, this will prevent Push notifications from coming through.

Duo may make recommendations on how to better secure your device. Click on the pop-up in your Duo mobile app to see what needs to be updated. These can also be completed at a later time.

2FA is an additional layer of authentication beyond a username and password. 2FA involves something you know (password) plus something you have with you (like Duo Mobile on your smartphone) to prevent someone from logging in with only your password. With Duo 2FA, you still enter your username and password. The second factor provided by Duo is simply an added layer of security on top of your existing credentials.

Two factor authentication (2FA) is the most effective way to secure our computer accounts and it is easy to use! If you've ever received a text message to confirm your identity when you log into an online retailer or banking site, you've used 2FA. It allows you to confirm your identity by text message, phone call, mobile application, and other methods.

Duo authentication will be required for Office 365 web apps at this time. Other applications will be announced and added later.

Office 365 web applications include but are not limited to:

• Outlook Web Access (OWA)
• One Drive
• Microsoft Teams

Please review the Duo Mobile Privacy Information.

Duo's authentication prompt is fully compatible with popular screen readers and voiceover options on Apple and Android phones. It is most accessible on up-to-date version of the most popular browsers: Chrome, Safari, Firefox, and Edge. The Duo Mobile application for iOS and Android is also compatible with platform native text to speech and alternative navigation options.

Please review the Accessibility and Duo webpagefor the most complete and up-to-date information regarding accessibility including best practices and known issues.

Contact The IT Service Desk at 713-221-8031 if you need assistance.

If you travel internationally, don't worry - Duo authentication can work without cellular service or a wifi connection. You have several options that may be useful:

1. Smartphone - Even with cellular service disabled or without a wifi connection, you may use the Duo Mobile app to generate a passcode that you can use to authenticate your account. Simply choose the Enter a Passcode option when you get the Duo authentication prompt.
   To generate the passcode, open the Duo Mobile app on your phone and tap the down arrow symbol ∨ next to "University of Houston - Downtown".
2. Hardware token - if you don't have a smartphone and you travel internationally often, you may want to get a hardware token (contact the IT Service Desk to start the process).
   Simply choose the Enter a Passcode option when you get the Duo authentication prompt and then enter the passcode that shows on the hardware token.
3. ByPass Code - If you won't have a smartphone and a hardware token is not an option, it is possible to get a bypass code that you can use for Duo authentication for the duration of your trip. Contact the IT Service Desk to request this option.
   Then, simply choose the Enter a Passcode option when you get the Duo authentication prompt and enter the bypass code that you were given.
4. Normal options - If you have cellular service or a wifi connection, then you can simply use whatever authentication technique you normally use. The push, passcode, and phone call options all work overseas. You can even add an international phone number as one of your authentication options.