Multi-factor Authentication

You are encouraged to generate backup codes ahead of time so that you can access your accounts without your phone. Generating access codes is recommended to be completed at the same time you enroll in MFA.

To use a backup code, see "Authenticating with a backup code".

It is also recommended that you enroll multiple devices, such as a smart phone and a tablet to reduce the chances that you can not access a device in order to use MFA.

If you are unable to access your account, please call the IT Support Centre.

You may remove your own device using the Device Management Portal from any web browser. You will have to authenticate with a backup code, a secondary enrolled device, or hardware token.

If you can not access the Device Management Portal you should contact the IT Support Centre as soon as possible to remove the lost device from Duo. This may occur if you only have one method of using MFA set up. We encourage having backup codes and multiple devices added.

You may remove your own device using the from any web browser via the Device Management Portal. You will have to authenticate with a backup code, a secondary enrolled device, or hardware token.  See instructions on how to remove devices.

If you can not access the Device Management Portal, you should contact the IT Support Centre as soon as possible to remove the lost device from Duo. 

Lost or stolen tokens can be replaced by contacting ITSC or following the remove hardware token instructions. It is the responsibility of the hardware token user to report any lost or stolen hardware tokens as soon as possible to ensure they are removed from your account.

When visiting the IT Support Centre to receive a hardware token, remember your photo identification to provide proof of your identity.

Hardware Token devices which are lost, stolen, or damaged repeatedly may have replacement costs billed to the user.

You will need to add your new phone and remove your old phone. There are several options to achieve this.

• If you still have access to your old phone and wish to add your new phone, you can add the new phone as a secondary device, then remove the old phone.
• If you are restoring your new phone from a backup, you can use Duo Restore, which allows you to migrate Duo from your old device to a new device. Please see: https://guide.duo.com/duo-restore
• Alternatively, you can use a backup code to access to the Device Management Portal to add the new phone and remove the old one.

These examples are documented in the Device Management Guide.

Assume that someone is trying to access your account without authorization, and that your password has been compromised. 

• First, press the red "Deny" button in the Duo app to block the request. 
• Do NOT approve the request. 
• Duo Mobile may ask why you are denying the request. If you suspect fraudulent activity, select "It seems fraudulent" to report it to Information Security. Select "It was a mistake" if you know it wasn't fraudulent.

• Secondly, change your password. If you are seeing a Duo prompt that you did not initiate, this indicates that someone else is using your password. Instructions on how to change your U of R password.

If you are receiving one or more prompts in the Duo app that do not correspond to a log in attempt initiated by you, then this indicates that someone has your password and is trying to use it. It is critical that you deny any Duo prompt that is not expected. Do not approve any Duo Push Notifications which you did not initiate yourself.

There are several things to ensure to diagnose when using Duo Mobile pushes:

• Ensure that you are sending the push to your device by pressing "Send Me a Push" when you are trying to authenticate.
• Ensure that your device is connected to the internet via wifi or mobile data.
• The display of messages is device-dependent and differs between Android and Apple (iOS) devices. If Duo has sent a Push request to your mobile device but the message is not visible, swiping down on your home screen should display the request.
• Otherwise, you can tap open Duo Mobile and any pending authentication requests will display as bars near the top of the app.
• If you have difficulty receiving push notifications to your mobile device please see:

     Troubleshooting Duo Push notification issues on iOS devices
     Troubleshooting Duo Push notification issues on Android devices

Duo Mobile requires that your authentication device has a data connection to the Internet via Wi-Fi or your service provider’s cellular data network to receive push notifications. To ensure that you have a connection, you can try the following:

• Restart your device.
• Ensure that the time and date on your device are correct.
• Enable airplane mode and then disable airplane mode to force the device to reconnect to a network.
• If you are connected to a weak wifi network, you can try disabling wifi to utilize your cellular data connection.
• To confirm a network connection, try visiting a website that you've never been to before (so it isn't cached on your device).
• If you are able to authenticate to the Device Management Portal, you can try to reactivate your device.
• Should none of these actions help, see the Duo Knowledge Base for additional iOS and Android troubleshooting steps.
• If you've tried the suggestions here but can't get Duo Push working or reactivate your device yourself, please contact the IT Support Centre.

When logging in, after entering your username and password, the Duo prompt does not display as expected. Symptoms include:

• A grey box with no options instead of the Duo Prompt.
• The message "Session Expired".
• The following error appears: "You cannot browse this page at "duo.com" because it is restricted."

To resolve these issues:

• Make sure that JavaScript is enabled in Safari on your macOS or iOS device. 
• Disable content restrictions on the device.

For instruction see the following Duo article; How do I resolve Duo Prompt display issues related to iOS or macOS content restrictions?.

If you enter an incorrect code too many times, your account can become locked. If this happens, you will see the following error:

"Your account has been locked out due to excessive authentication failures. Please contact your administrator."

This error may result from any code being entered incorrectly multiple times, or attempting to use an invalid code (previously used, or expired). This could be a backup code, a bypass code, a code from a hardware token, or a code from Duo Mobile.

If you do not have a valid code or device for authentication, please contact ITSC to gain access to your account.

If you have a valid means to gain access to your account such as via Duo Mobile Push, you can try to use this. Your account will remain locked for a period of time after which it will become unlocked and you will be able to authenticate.

If your account is/was locked and you did not initiate the MFA authentication requests (you did not submit the incorrect codes), please contact ITSC as this indicates your password is known to an unauthorized third party.

Logging in to some systems requires that a user be enrolled in MFA. If you attempt to log into a system for which MFA is mandatory, you may see the following error:

"Access is not Allowed because you are not enrolled in Duo." 

The error will appear as:



If you have attempted to sign on to a system which requires authentication by Multi-Factor Authentication (MFA) and you have not yet enrolled in MFA, you will see this error.

Applications such as Banner and FAST require users to be enrolled in MFA.

To enroll in MFA, follow the enrollment guide.

Once you are enrolled, you will be able to access applications which require MFA.

When authenticating using Duo Mobile Push, authentication attempts sent to your mobile device will expire after 60 seconds if you don't respond. This timeout is not configurable.

If you receive a "Login timed out" error within your web browser while, you should send your device another push and respond within 60 seconds, or enter a passcode.

This error will state "Request expired: Duo Mobile was unable to authenticate you because your request timed out. Please try again." in the Duo Mobile app.  Please send another push to your device, or use a passcode.

When a user successfully enters their username and password, and then is prompted by Duo within the web browser to send a push or enter a passcode, but performs no action, the session may expire after a period of time.

Please refresh the browser page, and log in again with your username and password. You will once again be presented with an option to either send me a push or enter a passcode. A response will be required within a few minutes to avoid the session expiring.

The MFA website provides instructions on how to enroll devices, manage devices, and authenticate. Additional resources and FAQs are provided to help guide MFA users.

If you require assistance, troubleshooting, or have questions about MFA, please contact the Information Technology Support Centre. Duo MFA is officially supported by the University of Regina.