Duo Enrollment

Las instrucciones de inscripción de Duo también están disponibles en español.

If you work for the College of Health Sciences or the UCI Medical Center, your choices are slightly different. If you don't have a mobile phone and want to use a hardware token instead, please refer to this page to learn how to buy a Yubikey hardware token and how to properly register it. For Yubikey hardware token support, contact the HS Help Desk at (714) 456-3333. If you would like to use your mobile device for the Duo software token, contact the OIT Help Desk at oit@uci.edu or call (949) 824-2222.

Enroll your mobile device

Before We Get Started

In this tutorial we will use your mobile device, such as a smartphone or tablet, and a computer to register for Duo multifactor authentication. You will need to install the Duo Mobile app onto your mobile device, which will act as a “Software Token” for Duo prompts once you’re signed up. Whenever you see “Software Token” in this tutorial, it is referring to the Duo Mobile app on your device.

From your mobile device, download the Duo Mobile app (there are versions for iOS and Android). Once the app is installed, set your mobile device aside and come back to these instructions. When you have completed the enrollment process, select the 'After you've enrolled' tab up above (or down below if you're reading this on a mobile device) to learn how you'll use Duo everyday to protect your account.

Ready? Let's get started!

1. From your computer, right click the following link and select "Open Link in New Tab". This way, you can continue to follow these instructions while you go through the enrollment process. Here's the link: Duo Support Desk. If prompted, sign in with your UCInetID and password. Once you arrive at the Duo Support Desk page, under the "Add Software Token" heading, select the Software Token Registration link.

Software token registration

2. The enrollment process will begin. Select the Start Setup button.

Start Setup

3. If you're enrolling a mobile phone, select Continue.

What type of device are you adding?

4. Enter your phone number, check the box to confirm you've entered the right number, and then select Continue.

Enter your phone number

5. Select the type of phone that you're enrolling (iPhone, Android, Windows Phone), then select Continue.

What type of phone is ?

6. Select I have Duo Mobile installed.

Install Duo Mobile

7. When you get to this screen, you'll need to pick up your phone (or tablet) where you installed the Duo Mobile app and scan the QR code on the screen (highlighted in RED below). We'll show you how to do this in a moment. The Continue button is greyed out until you complete this step.

Activate Duo Mobile

8. When you open the Duo Mobile app, it'll look like this. Press the Add Account button at the bottom.

Add account

9. Duo will need to access your camera to scan the QR code. Tap OK to give the app permission.

Permission to access camera

10. The app now has camera access. Hold your phone up to your computer screen so the QR code is centered on your phone's screen. Duo will auto-detect and scan the QR code (aka it'll snap a picture). Here's a 5 second video demonstration (courtesy of Duo).

11. Once you scan the code, the token will appear in the app.

Duo Passcodes

12. On your computer screen, a green checkmark will appear in the middle of the QR code and the Continue button will turn green. Select Continue to finish the setup.

Activate Duo Mobile

13. You're almost done! If you'd like, you can select Continue to Login OR you can make one other change (see the next step).

My settings and devices

14. If you'd like to have Duo automatically send a push (instead of having to enter a passcode when signing in), select the pulldown menu and choose that option. Then select Continue to Login.

Device options

15. Select the Send Me a Push button, and your phone will receive a push (see the next step).

Choose an authentication method

16. A push was sent to your phone, so please check the Duo Mobile app on your phone.

Pushed a login request to your device

17. Tap Approve on your phone to accept the push.

Login Request

18. After you approve the push on your phone, go back to your computer. You'll now have a chance to generate your Emergency Backup Codes, which you'll need to use in case you misplace or replace your phone. Select the EMERGENCY BACKUP CODES link.

Emergency backup codes

19. Now, select the Generate button.

Generate

20. Here are your Emergency Backup Codes! They are unique to you (they are not the same as in the picture below). Copy and paste those codes somewhere and save them in case of emergency. If you ever need to use one, just enter one of the codes when prompted and scratch it off of the list (you can't use the same emergency code more than once).

Sample emergency back up codes

YOU'RE DONE!

If you'd like, you can watch a 4 minute video that guides you through the entire enrollment process.

Can I enroll my mobile device without a computer?

It is possible to enroll your mobile device from the device itself, but the process is not as streamlined and there are a few caveats:

  • Make sure you download the Duo Mobile app first from either the Apple App Store or Google Play Store.
  • The Software Token Registration page is not currently 'responsive', meaning it will not resize to fit your mobile screen. The text will appear small so you may have to pinch and zoom to read the text and tap the buttons.
  • Very important! During the enrollment process, your web browser will open the Duo Mobile app on your phone to install the token. Afterwards, you'll have to switch back to your browser to complete the enrollment process.

After You've Enrolled

Now that you are enrolled, learn more about how to use Duo.

I don't have a mobile device

Before We Get Started

In this tutorial we will use a physical hardware token and a computer to register for Duo multifactor authentication. You will need to obtain a Duo hardware token from your department coordinator. Your department coordinator is identified in department specific communication regarding this initiative to you. If you’re not sure who to contact, please open a ticket.

If you don’t have a mobile device, the campus has funded independent Duo tokens for your use. Tokens will be distributed to your department’s security coordinator.

Alternatively, you can purchase a third-party hardware token from vendors like Yubikey. If you have a Yubikey, follow this link to enroll.

Ready? Let's get started!

1. From your computer, right click the following link and select "Open Link in New Tab". This way, you can continue to follow these instructions while you go through the enrollment process. Here's the link: Duo Support Desk. If prompted, sign in with your UCInetID and password. Once you arrive at the Duo Support Desk page, under the "Add Duo Hardware Token" heading, select the Duo Hardware Token Registration link.

Duo hardware tokens

2. On the next page, you'll need to enter your hardware token's serial number, which can be found on the back of the token. Please note that some of the hardware token serial numbers will just be a string of numbers, and some will begin with the letters 'DSEC'. After you enter the number, select Register.

Register hardware token

3. You're done! Feel free to test your by selecting the Test Token link at the top of the page.

Test Token

4. If prompted, you should login with your UCInetID and password. When you arrive at the UCI MultiFactor Login page (see below), select the Enter a Passcode button.

Enter a passcode

5. Type in the 6-digit code that appears on your hardware token's screen, and then select Log in.

Login using passcode

6. Success! You should see the success confirmation below.

You have successfully authenticated

NOTE: The hardware token has a button on it that displays the token code when it is pressed. If the button is pressed too many times without the token code being used to log in, the token will get out of sync and you won't be able to log in until it is resynced. Having the token in your pocket or backpack with keys or other objects that could press on the button will cause this to happen. Contact the OIT Help Desk to get the token resynced.

Here's a 4 minute video that guides you through the entire process.

After You've Enrolled

Now that you are enrolled, learn more about how to use Duo.

After you've enrolled

How to use Duo after you have enrolled

Duo 101: How to send a push to your mobile device

1. Log in to a WebAuth-enabled service (such as Zotportal or Canvas) as your normally would with your UCInetID and password.

WebAuth Login Screen

2. On the UCI MultiFactor Login screen, select Send Me a Push.

Send Me a Push

3. The screen will change to let you know that a push was sent to your mobile device.

Pushed a login request to your device

4. Open the Duo Mobile app on your mobile device and you should see the message "Request Waiting. Tap to Respond..." up top. Tap that message in the green bar.

Request Waiting

5. The request will open. Tap Approve in the bottom left. That's it! You should now be whisked away to the website you were trying to visit on your computer (Zotportal, Canvas etc).

Approve or Deny

Duo 201: How to enter a passcode from your mobile device

1. Log in to a WebAuth-enabled service (such as Zotportal or Canvas) as your normally would with your UCInetID and password.

WebAuth Login Screen

2. On the UCI MultiFactor Login screen, select Enter a Passcode.

Enter a passcode

3. Open the Duo Mobile app and tap the 'Duo-Protected University of California - Irvine' token to expand it and reveal a 6-digit code that you can use.

Duo Protected

3.5. NOTE: If you have a hardware token, simply press the button on the token to generate a 6-digit code. Skip to step 5.

Duo hardware token

4. The software token will expand and a 6-digit code will appear. This is what you will type on the UCI MultiFactor login screen in the next step. OPTIONAL: If you want to generate a different code, tap the swirling arrows on the right and the code will change.

Duo code example

5. Type that 6-digit code in the empty box on the UCI MultiFactor login screen, and then select Log in. That's it! You should now be whisked away to the website you were trying to visit on your computer (Zotportal, Canvas etc).

Enter duo code

Remember me for 24 hours

1. Log in to a WebAuth-enabled service (such as Zotportal or Canvas) as your normally would with your UCInetID and password.

WebAuth

2. On the UCI MultiFactor Login screen, check the 'Remember me for 24 hours' box. and then press Send Me a Push or Enter a Passcode (depending on whether you want Duo to send a push to your phone or if you want to enter a passcode instead). That's it!

Remember Me for 24 Hours

NOTE: If the check box is greyed out, you may have to click the "Cancel" button on the web page screen where it says "Pushed a login request to your device...". Once you do, the "Remember me" checkbox should now be editable.

Duo + WebAuth service

Your account has been automatically opted-in to the Duo + WebAuth service. WebAuth is the login page you encounter everyday, where you enter your UCInetID and password prior to accessing services such as Zotportal or Canvas.

You participation in the Duo + WebAuth service is optional at the present time. You can opt-out of the service for the time being as follows:

  1. Visit the Duo Support Desk homepage.
  2. Near the top of the page, look for the phrase Current WebAuth Opt-In Status.
    • If your opt-in status is ENABLED, select the WebAuth Opt-In link at the top of the page, select Disable, and then select Submit.
  3. If you return to the Duo Support Desk homepage, it should now display your opt-in status as DISABLED.

How will I know if this service is enabled?

The WebAuth login page normally looks like this:

login screen

WebAuth Login Screen Example

After you login, you'll now see the UCI MultiFactor Login page.

Webauth login page with Push and Passcode buttons

Duo MFA Authentication Example - Send a Duo Push or Enter a Passcode

Generate backup codes

You'll need these in case you misplace or replace your phone.

You've probably heard that you shouldn't write down your password, but these backup codes are an exception. You should definitely print these or write these down and keep them handy in a place where you can find them in an emergency, like your wallet, pocketbook, or purse. These are single-use codes, so after you use a code it cannot be used again.

To generate your backup codes:

  1. Visit this emergency backup codes page.
  2. Select the Generate button on the bottom of the page to receive 10 backup codes.
  3. Copy and paste the codes in a document, and then print the document.
    • Alternatively you can store the backup codes in your password vault like LastPass, KeePass etc.

Get Help with MFA

Already using MFA and have some questions or need some help?

About MFA

What is MFA and what are the benefits?

Scroll Up