Duo Help Guides

Duo 2FA at SCU supports the following methods:

The way each 2FA option works is described below, from the most secure (Touch ID) to the least secure (Phone Call).

Touch ID: Touch your Mac's Touch ID sensor when prompted to log in to the application. To use Touch ID with Duo, you must have:

• a MacBook Pro, MacBook Air, or Magic Keyboard with a Touch ID button
• a fingerprint enrolled in Touch ID (see Apple’s documentation for how to do this)
• Chrome 70 or later

Security Key: Plug a Security Key into a USB port, then tap or press it to verify your login. To use a security key with Duo, you must have:

• a supported browser
• an available USB port
• a Security Key

When you first register a Security Key, you may see a browser-specific dialog screen asking you to share the security key's make and model with Duo. You should accept/confirm this dialog before you can proceed with registration. No personal information is shared with Duo when this is done.

Need a Security Key? Employees can request a Security Key by contacting the Technology Help Desk.

Duo Mobile Push: Receive a login request on your smartphone or tablet with Duo Mobile installed. Review the request and tap Approve to log in to the application. The Duo Setup Quickstart gets you started with the Duo Mobile app.

Hardware Token Passcode: If you have a hardware token that generates a passcode, enter that passcode into the Duo Prompt, then click or tap Verify to log in.

Need a Hardware Token? Employees can contact Information Services at 408-554-4581 to request one.

Text Message (SMS) Passcode: Log in using a passcode received from Duo in a text message. The Duo Prompt will show that a text message was just sent to you with a passcode. When you receive the message, enter that passcode into the Duo Prompt, then click or tap Verify to log in.

Phone Call: Answer the phone call from Duo and follow the voice instructions to log in.

Note: This is the least-secure option, and it is significantly more expensive than any other verification method. Because of the cost incurred to the university, using a Phone Call should only be considered as an option of last resort.

In most cases, Duo Mobile Push is the best way to authenticate -- it’s quick and it’s secure. Read more from Duo

Don’t have a smartphone?

The most convenient and easy way to authenticate is by tapping the notification that pops up in the Duo Mobile smartphone app. However, the app is currently only available for Apple and Android smartphones. If you have a different type of phone, you will not be able to take advantage of the Duo Mobile app.

There are several options available for people in this situation:  use a Security Key, use a Text Message (SMS) passcode, or receive a voice call confirmation. Receiving a phone call is not recommended (except as a backup-of-last resort) as the cost to the University is significant.

This section is for first-time enrollment in Duo. If you have already enrolled in Duo, see the Add Or Manage Devices After First-time Enrollment section to add or update your enrolled devices.

Select your enrollment options

Review the Duo options shown in the section above, Deciding Which Duo Options To Use. Select a primary option (Duo Mobile Push is recommended), and select a backup option that works for you (like a Duo Mobile on a tablet, or a phone call to a landline).

To get started with the Duo Mobile App...

The Duo Setup Quickstart will get you started with the Duo Mobile app.

Don’t have a smartphone, or don’t want to use the Duo Mobile App?

If you don't have a smartphone, or if you don't want to use the Duo Mobile app, follow the detailed instructions in the Duo guide to set up other options:

Step 1: Introduction

Go to the MySCU Login portal. Click on a tile for a Duo-protected application (such as Google Workspace), and you will be prompted to set up your Duo account.

Step 2: Choose Your Verification Method

The verification methods are shown in the Duo guide, with the most secure options at the top of this list.

Step 3: Add Your Chosen Method

Once you choose the method to verify your identity, follow the step-by-step instructions in the Duo guide to add that method.

Step 4: Add a Backup Method

Add a second verification method that you can use as a backup if the first method you added isn’t available, like if you lose or forget your phone and need to log in with Duo, or if you want to access an application from a different MacBook than the one you used to set up Touch ID in Duo.

Once you’ve added a backup method, you’re at the end of the Duo setup process. Click Log in with Duo to log in to the application using the Duo method you just added.

From the Duo Device Portal, you can add additional verification methods, manage your existing devices, or re-activate Duo Mobile if you've changed phones.

On the MySCU Login portal, click on the "Manage Duo Devices" tile.

To continue to the device management portal, you'll need to verify your identity, just as you do when logging in to an application protected by 2FA. Once you're verified, you can rename or delete any of your registered devices. To add a new device, click the “Add a device” button and the setup wizard will walk you through the process.

When presented with the Duo authentication prompt, you will be asked whether you want to “Trust this browser?”. If you select the option Yes, trust browser, you will not receive Duo prompts for additional SCU SSO applications for 12 hours, except in certain circumstances described below. For example, if at 8am you get prompted to authenticate to Duo to access Gmail, and you check the box to trust the browser, you will be able to open Workday that afternoon on the same computer and browser and not get a Duo prompt.

So what are these certain circumstances referred to above?

1. The VPN will always prompt you to authenticate with Duo.
2. It is device and browser specific, not account specific. This means if you access Workday on your tablet and use the “Trust Browser” feature, if you then use your computer to access Workday later the same day, you will be prompted with Duo again. Similarly, if you use Firefox on your computer to access Workday in the morning, you will be prompted by Duo again if you switch to Chrome later in the day.
3. If you have configured your browser to deny third-party cookies or to prevent cross-site tracking, the “Trust Browser” feature will not work. Instructions from Duo for how to add an exception in your browser.

IMPORTANT: Remember not to select this option unless you are using a computer you own or control. Do not use this option on a lab workstation or a shared computer.

If you have replaced the phone you activated for Duo Mobile Push, or if Duo Mobile Push stops working, you can get it working again through self-service. If a Duo Mobile Push authentication times out, you'll see the I got a new phone option shown in the Universal Prompt. Click or tap that link to begin the process to re-activate your phone.

If you are still using the same phone number, click or tap Text me a link. You’ll use the reactivation link to get Duo Mobile working again.

If you have a new phone number, click or tap Continue to proceed to the Duo device management portal. From there, you can complete the steps to add your new phone number and set up Duo Mobile Push on the new phone so you can use it to log in with Duo.

The Duo guide shows the detailed steps to follow to reactivate Duo Mobile.

NOTE: If you used the old phone just to receive Duo voice calls or text messages, and you are keeping the same number, you don't have to do anything; Duo will still work.

There are several options for using Duo while traveling:

Bypass Code: In the event that you've lost or left your phone or hardware token at home, you may have no way of authenticating to Duo. You can get a single use, temporary bypass code from either the Technology Help Desk or by using the Bypass Code Generator. Note, you must have previously set up alternative (non-SCU) contact information to use the Bypass Code Generator.

Once you have your code, click or tap on Other options, then select I have a bypass code in the Duo prompt. Type in the bypass code, then click or tap Verify to log in.

Security Key: If you don't have a mobile phone, or don't want to enroll one, you can enroll a Security Key as a verification method. Bring your Security Key with you to authenticate when traveling. Employees can request a Security Key by contacting the Technology Help Desk.

When you first register a Security Key, you may see a browser-specific dialog screen asking you to share the security key's make and model with Duo. You must accept/confirm this dialog before you can proceed with registration. No personal information is shared with Duo when this is done.