Duo 2FA: Frequently Asked Questions

Yes. Duo Two-Factor Authentication is required to access Microsoft 365 applications. All students, faculty, and staff must register a device with Duo to access email, Microsoft Teams, and other Microsoft 365 services.

All students, faculty, and staff must register a device with Duo to access email, Microsoft Teams, and other Microsoft 365 services.

• • Within 48 hours of activation, expect multiple login prompts from each Microsoft application (Outlook, Teams, etc.) you use. Going forward, future prompting to reauthenticate will be less frequent, usually weeks in between.

• • The Microsoft 365 portal will prompt for Duo authentication. If the browser is set to save your password, you will not be Duo prompted with each login.

• • For the best experience on iOS or Android, use the Outlook App. You can expect to be prompted by Duo initially.
  • The “built-in” Mail app on iPhone/iOS is supported with Duo but you may need to remove and re-add your Exchange account – in some cases you must disconnect and reconnect to the wireless network in order for the setup process to complete. An e-mail may also appear (looks suspicious but is legitimate) on your iPhone notifying you that your admin made changes when syncing stops working.
  • The “built-in” Mail app on Android is not supported with Duo. Outlook for Android or a 3rd party app such as Nine ($14.99) are the only supported clients.

See the tips below or watch this video walk-through for how to resolve this issue.

• Remove and re-add your Exchange account from your iPhone or iPad.
• You may have to disconnect/reconnect the wireless network in order for the setup to complete successfully.
• Note that when setting up a new account, you must enter your e-mail address as NetID@colostate.edu.

The built-in Android mail client is not support by Duo authentication. Download and install the Outlook for Android app or purchase the Nine e-mail client from the Google Play store to access your email from an Android device.

The initial setup of DUO requires you to authenticate with each application (Outlook, Teams, etc.) individually. After the initial setup, applications will “save” your login information.

You can register and authenticate using any and all of the following methods:

•    The Duo Mobile App (Recommended): Download the Duo Mobile App from your smartphone or tablet’s app store. This method will allow Duo to push a message to your phone or tablet where you can verify your identity by tapping on the screen.

•    Any Phone Number: You can register your cell phone, desk phone, home phone, etc. and the system will call you to validate your identity.

•    A Hardware Token: (CSU-FC only) These can be purchased from RamTech and will be registered to your account at time of purchase. Hardware tokens generate a six-digit code that you can use to authenticate.

We recommend that you setup more than one device as a 2^nd factor authentication method with Duo. If you lose, misplace or simply forget a device, having a second registered device will save the day.

If you’ve lost or are unable to use your cell phone, hardware token, or any other device you’ve registered with Duo and do not have an alternate/back-up device registered,

• CSU Fort Collins: contact the CSU IT Help Desk at (970) 491-7276 or help@colostate.edu for assistance with setting up a new device.
• CSU Pueblo: contact the CSU Pueblo IT Help Desk at (719) 549-2002 or by visiting the Help Desk Solutions Center for assistance with setting up a new device.

We also recommend enabling Duo Restore, Duo Mobile’s restore functionality lets you back up Duo-protected accounts for recovery to the same device or to a new device.

If you’ve lost your cell phone, hardware token, or any other device you’ve registered with Duo, you can remove it through the tools within the NetID website if you have another device registered.

If you do not have a backup device registered with Duo,

• CSU Fort Collins: contact the CSU IT Help Desk at (970) 491-7276 or help@colostate.edu for assistance with setting up a new device.
• CSU Pueblo: contact the CSU Pueblo IT Help Desk at (719) 549-2002 or by visiting the Help Desk Solutions Center for assistance with setting up a new device.

We also recommend enabling Duo Restore, Duo Mobile’s restore functionality lets you back up Duo-protected accounts for recovery to the same device or to a new device.

Yes! Whether your phone number has changed or you have a new device (with the same number), you’ll need to go through the registration process again.

We also recommend enabling Duo Restore, Duo Mobile’s restore functionality lets you back up Duo-protected accounts for recovery to the same device or to a new device.

• If you have an alternate/backup device registered:
  • Log in to the NetID website with your NetID and Password.
  • Before authenticating with Duo, click on ‘My Settings & Devices’ on the left hand side of the screen

• • You will need to authenticate with your preferred method before you are taken to the next screen.
  • Under My Settings & Devices, find the device you want to remove, click the ‘Device Options’ button, and then click the trash can icon to remove it.
  • You can then click the ‘+Add another device’ link under your registered devices list or ‘Add a new device’ from the menu on the left to set up your new phone.

Fort Collins users: If you do not have an alternate/back-up device registered in Duo, contact the CSU IT Help Desk for assistance at (970) 491-7276 or help@colostate.edu.

Pueblo users: If you do no have an alternate/back-up device registered in Duo, contact the CSU Pueblo IT Help Desk at (719) 549-2002 or by visiting the Help Desk Solutions Center for assistance.

Duo recommends upgrading to the most recent version of iOS or Android available for your device.

Wondering if your phone or tablet meets the requirements for the Duo Mobile app? See the Duo articles below for more information:

• Which versions of iOS does Duo Mobile support?
• Which versions of Android does Duo Mobile support?

If the device you use to authenticate with runs on an unsupported operating version, we recommend upgrading to the latest iOS or Android version as CSU IT staff has limited ability to escalate issues that may arise.

If your device does not meet the requirements for the Duo Mobile app, you can still authenticate with a phone call to that device.

Upon logging in with your CSU credentials, the Duo prompt will populate allowing users to choose how to verify their identity.

If you have more than one device registered, make sure to select the one you want to use for this session from the Device dropdown menu.

You can then select which authentication method you want to use for that session.

Users can also specify which device should be the default.

• Log in to the NetID website with your NetID and Password.
• Before authenticating, click on ‘My Settings & Devices’ on the left hand side of the screen. Note: you will need to authenticate before moving to the next menu

Then click the Default Device: drop-down menu and pick your default device for authentication. Click Save if you’re done making changes.

Duo Mobile’s restore functionality lets you back up Duo-protected accounts for recovery to the same device or to a new device. For instructions on enabling this feature, please see Duo’s guide for Duo Restore.

This functionality is supported and recommended. Note: your device will have to be backed up to iCloud (iOS) or Google Drive (Android) for this to work.

If you are a part of CSU Fort Collins, you can buy a hardware token at RamTech for $23.75 and the staff will register the token for you.  See What to Expect: Duo Authentication for more information on using a hardware token to authenticate.

Hardware tokens are not currently supported at CSU Pueblo.

If your phone is already in the Registered Devices list, you do not need to add it again.

To resolve the error, choose one of these workarounds:

• If you have not registered any other devices, log out and log in again, and follow the instructions for registering a device if none are registered.
• If you will only be logging in with this device using Duo “Send Me a Push” and not a phone call, you can leave the phone number blank.
• If you must include a phone number, you could enter an arbitrary number in the optional Extension field. (An extension is one or more extra digits normally used to connect to an internal phone of a business or organization. A fake extension, such as 99, would be ignored by most phones, and the combination of phone number plus extension would be unique for Duo purposes.)
• If you are no longer using the device, remove the device from the NetID Two Factor Authentication page.

If your device does not ring after you’ve selected the Phone Call authentication method, it could be your call spam filters on your phone. We recommend using the Duo Mobile App or Hardware Tokens instead of authenticating with a phone call.

International phone numbers are supported in Duo. When filling out the device information, enter a plus sign (+), followed by the Country Code, and the phone number, in the Phone Number field. These numbers should be all in one string; no spaces or dashes. For example: +441234567890

If the Duo Prompt does not display as expected while attempting to log in on iOS or macOS, please see this Duo support article for resolution. Having Screen Time enabled can also cause Duo prompt issues.

Effective June 30, 2023, Duo no longer supports Transport Layer Security (TLS) versions 1.0 or 1.1 for any Duo product or service. After June 30, 2023, TLS 1.0 and 1.1 connection requests to Duo will not receive a response, resulting in blocked multi-factor authentication. Please follow the guide to updating Duo for TLS version 1.2 for any clients that authenticate with these versions and plan for the migration as soon as possible to avoid service disruption.