Duo multi-factor authentication - FAQ

Requiring MFA when logging into Buff Portal and MyCUInfo will better secure personal and financial data on our campus. The U.S Department of Education and payment service providers now require these safeguards to protect financial data and educational records. We need to be sure our campus is doing everything it can to reasonably protect information and adhere to the requirements of the government and our service partners.

Duo MFA and Microsoft MFA are similar applications that are used to authenticate to different systems. At this time, our campus uses Microsoft MFA only for Microsoft-hosted applications. Duo MFA will be used for other services at CU Boulder including Buff Portal, MyCUInfo, Grouper, Marketing Cloud, Oracle Identity Manager, Research Computing services, and others. 

Duo MFA will be implemented for Buff Portal and MyCUInfo on January 9, 2024.

Yes. Services that require Duo MFA (including Buff Portal and MyCUInfo) will always require you to authenticate whether you're on or off campus.

Duo has an 8-hour time out, per session. So, if you access one service in a web browser (like Buff Portal) and then within the same browsing session and 8 hour time limit you access another service that requires Duo (like MyCUInfo) in the same browser you will not be required to authenticate with Duo a second time. If you switch to a different web browser, you will be prompted to authenticate again. 

Yes. Employees who already use Duo to access certain resources in MyCUInfo are required to enroll with the CU Boulder instance of Duo. OIT is working with the CU System Office to remove their instance of Duo from MyCUInfo soon after this deployment, so employees will not need to manage two different Duo enrollments.

If you are already using the CU Boulder instance of Duo to access Grouper, Aurora, Oracle Identity Manager or use Research Computing services, there’s nothing you need to do before January. Not sure if you're enrolled? Visit the Duo multi-factor authentication enrollment website to test authentication and check your settings. 

FIDO2 tokens are physical devices that provide a second factor during the multi-factor authentication process. They may be a good option if you are unable to use a mobile phone for MFA. Follow our Register a Yubikey for OTP or Duo - enroll a security key tutorials to enroll one of these devices. 

Please note that it is your responsibility to purchase, configure, and keep track of your token. 

If you decide to use the DUO security key option for your second factor of authentication and leverage Yubikey or FIDO2 tokens, it is highly recommended to register a backup method, such as a phone, in addition to your token in case you misplace it.

Duo has several options available to enroll and authenticate. 

• Go to the Duo multi-factor authentication enrollment website and log in with your IdentiKey username and password. 
• Select the method you'd like to use to authenticate. Your options include: 
  • Duo Mobile app (recommended): Get a push notification from the Duo Mobile app on your smartphone or watch.
  • Phone number: Set up a phone number then choose between receiving a text message with a code or an automated phone call during which you can approve access by pressing 1 on your keypad.
  • Security key: Use a device like a Yubikey to verify your identity.
• Follow the prompts to complete enrollment. When finished you can revisit the Duo multi-factor authentication enrollment website in an incognito window to test enrollment. 

Select the option to enter a phone number then choose between receiving a phone call or text message to authenticate. Follow our Duo enroll and set up with a phone number tutorial to enroll a phone number. 

• Go to the Duo multi-factor authentication enrollment website and log in with your IdentiKey username and password.
• When prompted, click Other Options
• Select Manage Devices 
• You'll have to authenticate with your current device before you can add a new one. 
• Click Add a device and follow the prompts to add a new authentication method. 
• After adding a new device, we recommend visiting the Duo multi-factor authentication enrollment website with a new browser or with a private/incognito window to force authentication to verify success. 

Follow our instructions for managing devices for screenshots of this process. 

Visit the Duo multi-factor authentication enrollment website at any time to view your settings, re-register the app, or add a new device.

Troubleshooting tips: 

1. Go to the Duo Two Factor Enrollment website and log in with your IdentiKey username and password.
2. If Duo pushes an authentication request that doesn't show up in your app, click Other options and select a different authentication method. 
3. If none of the options available work for authentication, contact the IT Service center at 303-735-4357 or oithelp@colorado.edu for a one-time bypass code to change your settings. Please note: To receive a one-time bypass code you will be required to get on a Zoom video call with an IT Service Center analyst and show proof of identity, using your Buff OneCard or a government issued photo ID. 
    

If prompted to enter a second password, type push. This will cause DUO to send a push notification to your device.

If you would like to use a Yubikey for one-time password (OTP) use, follow our Register a Yubikey for OTP or Duo - enroll a security key tutorials to enroll.