Duo Universal Prompt two-step verification methods

Overview

Learn how to setup and use the verification methods in two-step login using Duo Universal Prompt.

Available methods

Duo has an expansive catalog of authentication methods that are categorized into nine different groups listed by what Duo considers to be the most secure to least secure:

1. Platform authenticators
   1. Touch ID and Face ID on macOS computers and iOS devices
   2. Windows Hello for Windows computers
   3. Biometrics for Android devices
2. Roaming authenticators
   1. Security keys (USB devices for compatible browsers)
3. Verified Duo Push
   1. Pushes a notification to the Duo Mobile app
   2. Requires a code to be entered on the mobile device to verify
4. YubiKey passcodes
5. Duo Mobile generated passcodes
   1. Found in the Duo Mobile app. Tap the UO account row to expand it to find a passcode. 
6. Hardware token passcodes
   1. Press the button
   2. Enter the six- or seven-digit code that appears into the prompt
7. SMS passcodes
   1. Sent via text message
   2. Enter the passcode into the on-screen prompt
8. Phone call approval
   1. A registered phone number will be called to verify login.
   2. Dial 1 to approve, dial 9 to deny.

Setup a new authentication method

For first-time Duo users

Logging into a Duo-protected application enabled for self-enrollment takes you to the device management page to enroll. Click Next to learn why protecting your identity with two-step verification is important and begin the setup process.

Choose the device type in the list that matches your desired authentication experience:

• Touch ID: Use the fingerprint sensor on Apple MacBooks, Magic Keyboards, or iPhone.
• Face ID: Use the face scanning feature on iPhone.
• Windows Hello: Use your Windows Hello PIN, scan your fingerprint, or use facial recognition on Windows devices.
• Device verification: Use Android Biometrics on Android devices.
• Duo Mobile: Approve Duo Push verification requests on iOS or Android devices, or generate a one-time passcode from the Duo Mobile app.
• Phone number: Receive a one-time passcode in an SMS message or approve a login attempt with a phone call from Duo.

Only the USS-Technology Service Desk can add hardware tokens and HOTP tokens (e.g., YubiKeys) for you.

• These verification options do not show up in the list of available registration options.
• Neither do any methods that are blocked from use in our Duo tenant.

Duo recommends the most secure option of the methods available to you, so it's a good idea to set up that method first if you have a device that supports it.

For existing Duo users

Navigate to any Duo-protected service (e.g., Canvas, Outlook for the web, Banner) and log in with your Duck ID and password.

1. When you are prompted to select a Duo method, select the Other Options link at the bottom of the prompt.
2. Scroll down to the bottom of the list of registered methods and select Choose New Method.
3. You will see all of the registered methods in a tiled layout. A prompt will appear to select from a list of available methods that have yet to be registered.
   1. Note: If you have registered Touch ID already, it will appear again as an available method in correlation with Touch ID's capability of registering multiple fingerprints.
4. Select your desired method and follow the registration steps on the screen.

Using Duo

Logging in to a protected service

Go to a Duo-protected service and sign-in with your Duck ID and password:

1. A Duo prompt will appear, select the method that appears
   1.  If you have multiple methods, select Other options. (See Last available method below for more information.)
2. Interact according to the selected method.
3. Success!

Remember Me using Duo Universal Prompt

If you would like to have a method remembered by Duo so that you aren't prompted every time you log in to a protected service:

1. Log-in to a protected service with your Duck ID and password
2. When prompted for your Duo method, select your desired method and use it.
3. You will be prompted with the question, Is this your device? Select Yes, this is my device. This will allow Duo to remember you for seven days.
   

If you select, No, other people use this device, then you will see the Duo Universal Prompt every time you log in to the same device for the next 14 days.

For more information, please consult the Remember me in Duo Universal Prompt article.

Last available method

Once you have chosen a method of authentication, it will be chosen by Duo to verify your identity the next time you need to login to a protected service.

You can choose a different method by selecting the Other options link within the prompt. It will bring up any other registered methods on your account.

Time out

Any attempt to log in through a protected service will time out two minutes from initiating your desired verification method.

Need Help?

Please submit a request ticket on the Two-Step Login (Duo) Support service page or select Create A Ticket on this page.