Options for Multi-Factor Authentication (MFA)

Owned by Todd Haddaway
Last updated: Dec 12, 2023 by William Schneider
4 min read



Tell Me



This document describes the many options available to you when using Duo for multi-factor authentication (MFA) and includes links to enrollment instructions for each option. For a one-page chart designed to help you decide which options are right for you, refer to the Duo Multi-Factor Options at-a-Glance chart.

You must enroll a device in Duo before you can use it for multi-factor. We recommend that you enroll in a primary option plus at least one backup option. During each login session, you can choose which of your enrolled options to use.

Duo Mobile App on a Smartphone

Enrolling the Duo Mobile app on a smartphone (a cell phone that allows you to download and install applications) gives you the greatest number of options when you log in to a MFA-protected system. Most people find the push notification the most convenient option.

  • Push Notification: From the login page, click Send me a Push, open the push notification on your smartphone, and tap Approve to log in. Requires WiFi or mobile data connection. Duo Mobile Push uses a minimal amount of mobile data—less than 2 KB per authentication.

  • Generate a Passcode: No WiFi or mobile data connection needed! The app generates a passcode for you. When you log in and are prompted for two-factor, click the Enter a Passcode button, enter the passcode from the smartphone, then click Log In.

  • Phone Call (Faculty & Staff only): From the login page, click Call Me, answer the call on your phone, and press 1 to log in.

  • Passcodes via Text Message: From the login page, click Enter a Passcode, click Text me new codes, and receive a text message that includes 10 passcodes. Enter your passcode on the login page, and click Log In. Ten passcodes are sent because each can be used only once. Passcodes expire after 7 days.

Supported Device OS Versions: iPhone, Android, Windows Phone

Duo Mobile App on a Tablet

A tablet provides two options with the Duo Mobile app:

  • Push Notification: From the authentication page, click Send me a Push, open the push notification on your tablet, and tap Approve to log in. Requires WiFi or mobile data connection. Duo Mobile Push uses a minimal amount of mobile data – less than 2 KB per authentication.

  • Generate a Passcode: No WiFi or mobile data connection needed! The app generates a passcode for you. When you log in and are prompted for two-factor, click the Enter a Passcode button, enter the passcode from the tablet, then click Log In.

Supported Device OS Versions: iPad, Android

Duo Mobile App on an Apple Watch

An Apple Watch that you have paired with an iPhone with the Duo Mobile app provides two options:

  • Push Notification: From the authentication page, click Send me a Push, open the push notification on your Apple Watch, and tap Approve to log in. Requires WiFi or mobile data connection. Duo Mobile Push uses a minimal amount of mobile data – less than 2 KB per authentication.

  • Generate a Passcode: No WiFi or mobile data connection needed! The app generates a passcode for you. When you log in and are prompted for two-factor, click the Enter a Passcode button, enter the passcode from the Apple Watch, then click Log In.

Supported Device OS Versions: iPhone, Apple Watch

Duo Push Notifications on an Android Smartwatch

There is not a standalone Duo Mobile app for Android smartwatches, but you can approve authentication requests on your watch via the notification.

  • Push Notification: To approve authentications from an Android smartwatch or wearable device, your Android phone must be unlocked. If your phone is normally locked (recommended), you can enable Smart Lock on your Android phone in order to approve notification actions from a wearable device. For instructions, refer to Set your device to automatically unlock.

Other Cell Phone—Phone Call or Text

Cell phones with text messaging and phone service provide two options:

  • Phone Call (Faculty & Staff only): From the login page, click Call Me, answer the call on your phone, and press 1 to log in.

  • Passcodes via Text Message: From the login page, click Enter a Passcode, click Text me new codes, and receive a text message that includes 10 passcodes. Enter your passcode on the login page, and click Log In. Ten passcodes are sent because each can be used only once. Passcodes expire after 7 days.



Landline Phone Call

  • Phone Call (Faculty & Staff only): From the login page, click Call Me, answer the call on your phone, and press 1 to log in.

Duo Hardware Token

  • From the login page, click Enter a Passcode. Press the button on your Duo hardware token to generate a passcode, enter your passcode on the authentication page, and click Log In.

Some people have asked about the possibility of using third-party hardware tokens (for example, YubiKey) with Duo. At this time we are not enrolling third-party hardware tokens, although the options are being reviewed.



Request Help | Correct or Suggest an Article