MFA Device Management Guide

Welcome to the MFA Device Management Guide!

This document will share how to how to manage your MFA devices. This includes adding or removing devices from your MFA account. Learn about which second factor devices can be added to your MFA account.

Adding a Device to your MFA Account: We strongly recommend adding at least two devices to your MFA account in case you cannot access your primary device for any reason. Plan ahead by generating backup codes and enrolling a secondary mobile device so that you can always get into your account. If you cannot access your primary phone and have no backup codes or secondary devices, contact ITSC.

If you haven't already, ensure that you are an enrolled MFA user. To become an enrolled user, please complete the enrollment process detailed in the MFA Enrollment Guide.

Provided you are an enrolled user and have one MFA device already enrolled, you can use the Device Management Portal to add any of the following to your account:

Smartphone (recommended)
Tablet
Security Keys (U2F Tokens)

Hardware tokens can not be self-enrolled by the end user. See instructions on requesting a hardware token.

Removing a Device from your MFA Account: There are various reasons you may wish to remove a device from your Duo account. You may need to remove a device no longer in use, either because you have a new device or because the device is lost or stolen.

To reduce security risk, make sure you remove lost or stolen devices from your account immediately. If your lost or stolen device is University-owned, report it to ITSC as soon as possible.

Add a New Device Or Secondary Device to MFA

To complete the add MFA device process, you must be an enrolled MFA user with one or more devices already added to MFA.

Step 1) Log Into the Device Management Portal

On the main MFA page, click "Device Management Portal Login" button or go directly to https://novapp.cc.uregina.ca/perl/mfamanagedevice.cgi

Enter your username and password, and click the green "Login" Button.

Step 2) Add a new device

Click the "Add a new device" link as indicated with the red pointer and circle.

Note: Do not click "Send me a Push” or “Enter a Passcode" on this screen (you will be logged out). Instead, you will be promoted to use MFA to authenticate after you click “My Settings & Devices”.

Step 3) Authenticate with MFA Device

To ensure that you are authorized to add a device, you must first authenticate using MFA.

Choose an authentication device from the drop down menu if using "Send Me a Push" or "Enter a Passcode".

For details on how to authenticate, please see full instructions for Send Me a Push with Duo Mobile, or Enter a Passcode with Duo Mobile App, Enter a Passcode with Hardware Token, or Enter a Passcode with Backup Code.

Step 4) Enroll New Device

Proceed with the device enrollment process as shown in the initial Enrollment Guide.

As an example, let's add another phone.

Select the type of device to be added (Mobile phone, tablet, security key).

Note: Security keys are different than hardware tokens. If you wish to add a hardware token, please contact ITSC. Hardware tokens can not be self enrolled.

Step 5) Enter Mobile Phone Number

Enter and confirm the second phone's number.

Then, select the Device Type of the newly added device.

Step 6) Install and Activate Duo Mobile

Install and Activate Duo Mobile on the new phone and scan the barcode on the screen with the mobile phone to activate.

For full details of this step, see: Connect Duo Mobile to U of R Accounts in the Enrollment Guide.

Note: It is highly recommended to set "When I log in:" to "Ask me to choose an authentication method."

Your additional device is now added, and can be selected as an authentication option when logging in. See Authentications with Duo Mobile Push, Authentications with Duo Mobile Passcodes, or Authentications with Hardware Tokens.

The new phone is added and listed with your other enrolled devices. You can click "+ Add another device" to start the device enrollment process again and add another authenticator.

Removing a Device

If your new device is replacing the one you previously enrolled, you can remove the device you won't be using any more for authentication. For example, if you have a new phone added to your account, you can remove your old phone.

Note: Before removing a device, ensure that you have added a new device to replace it, or will have at least one MFA authentication device on your account remaining. You should remove a device from Duo after adding a new device to your account or if you have a backup device connected. If you delete all of your devices, you may be unable to authenticate, and will need assistance from the Information Technology Support Centre.

Note: While it is possible to remove a device from your MFA Device options, it is not possible to remove your account from MFA after enrolling as a user.

Step 1) Log Into the Device Management Portal

On the main MFA page, click "Device Management Portal" or go to https://novapp.cc.uregina.ca/perl/mfamanagedevice.cgi

Enter your username and password, and click the green "Login" Button.

Step 2) Click "My Setting & Devices"

Click the "My Settings and Devices" link as indicated with the red pointer and circle.

Note: Do not click "Send me a Push" or "Enter a Passcode" on this screen (you will be logged out). Instead, you will be promoted to use MFA to authenticate after you click "My Settings & Devices".

Step 3) Authenticate with MFA Device

To ensure that you are authorized to remove a device, you must first authenticate using MFA.

Choose an authentication device from the drop down menu if using "Send Me a Push". Selecting an authentication device is not required if using a passcode.

Step 4) Remove Device

Click the "Device Options" button next to the device you want to remove.

To remove, click the trash can button to delete that device.

You'll have the chance to confirm that you want to delete that device. If you wish to proceed, click "Remove".

The authentication device is removed from your profile. A green bar at the bottom of the Duo screen will confirm that the device has been removed.

The removed device can no longer be used for MFA authentications.