DUO Two-Factor Authentication
To increase security, UCSF requires everyone who accesses the UCSF network through VPN or uses Outlook web mail from a remote location to use Duo two-factor authentication. Two factor authentication verifies your identity on two separate devices (i.e. your computer and smartphone) through a 3rd party application, Duo.
All VPN or remote.ucsf.edu users must sign up for Duo by Tuesday, Dec. 5 to avoid disruption of access.
All Outlook web access users must sign up for Duo by Tuesday, Dec. 12 to avoid disruption of access.
Want to learn more about Duo and IT security? Visit it.ucsf.edu/security.
What is Duo?
Duo is a third-party application that UCSF uses for two-factor authentication, which makes it difficult to gain unauthorized access to an account because access requires a second factor (something you have, such as your smartphone).
To increase security, all users need to log into the University's VPN and OWA with DUO. Duo provides several options for you how you can authenticate, including through a smartphone app, a SMS text message to your cell phone or an automated phone call.
How Do I Enroll?
Automatic enrollment: If you received an email directly from Duo Security with the title "Duo Security Enrollment", this means you are automatically enrolled and can follow the directions in the email.
Manual enrollment: Follow the steps below
Step 1 – Fill out the enrollment form
To confirm your Active Directory login / username, or if you have multiple AD IDs and need to confirm which one is linked to your email, go to https://myaccess.ucsf.edu/myid. Your AD username will be the text in the first tab.
Now go to https://ucsf.service-now.com/ess/duo2factor.do and complete the requested information, including your AD ID that is linked to your email account and your domain. Click the "order now" button.
Step 2 – Download and install Duo App
Note for Zuckerberg San Francisco General Staff only: If you’re using ZSFG's WebConnect, you are one step ahead. The necessary app is installed on your phone already. You will be able to use the same Duo Mobile app on your Droids and iPhones, and enroll the new UCSF QR code to the app. After you activate your UCSF code, you will see one entry for SF Dept of Public Health, and one entry for UCSF. Skip to Step 3.
”Search for “Duo Mobile” in the App Store (iOS) or Google Play store (Android), or click on the appropriate link below from your smartphone:
Within the next 24 hours, you will get an email from Duo with a link in it that you must click to activate your Duo account.
Step 3 – Click on link in email
You will get an email from Duo with a link; click on it to activate Duo. You will then be prompted to enter your smartphone number so that you can use the Duo app. If you do not have one, a regular cell phone or even a landline can work. You will need access to that phone line when you are trying to use Duo.
Note: If the Service Desk is helping you with this process, you may get a text message with your activation link instead of an email.
You are now enrolled!
Step 4 - ONLY for people who use Pulse VPN or Remote.ucsf.edu
DO NOT COMPLETE THIS STEP UNTIL YOU HAVE RECEIVED THE EMAIL FROM STEP 3 AND CLICKED ON IT! You must finish Duo enrollment BEFORE you take this next step or VPN will not work.
1. Go to https://software.ucsf.edu.
2. Scroll down and click “Pulse Secure VPN.”
3. Pick “Pulse Secure - Dual Authentication” for either Mac or Windows and follow the instructions.
4. If using Windows, restart your computer.
5. Start using Pulse!
For Windows, from the Start Menu – Pulse Secure:
How do I use Duo once I'm enrolled?
What if my phone number changes?
Your phone will need to be re-activated by a Duo administrator. Go to http://help.ucsf.edu and click on the "Report something that just isn't working right" link. Fill out the form reporting that your Duo registered phone number has changed and asking that your new number be registered with Duo.
What if I get a new smartphone?
Your new phone will need to be activated. If you have the same phone number on your new smartphone as you had on your old smartphone, you can activate your new smartphone yourself.
- Go to https://remote.ucsf.edu.
- Login with your Active Directory ID and password.
- Click on "Add a new device" on the left side of the Duo authentication prompt.
- You'll be asked to authenticate with an existing Duo method. Choose either "Call Me" or "Enter a Passcode". Duo's automated system will either call you if you picked "Call Me" or send you a text message if you picked "Enter a Passcode". If you're being called, follow the directions in the automated phone call to authenticate. If you're receiving a passcode, enter the passcode you received.
- Select "Mobile phone" for the new device type and click "Continue".
- Enter your phone number. When you've finished typing the number, a check box will appear below that says "...This phone number already exists and will be replaced." Click the check box to enable that option then click the "Continue" button.
- Select the type of smartphone you're using and click "Continue"
- Follow the Install Duo Mobile for iOS instructions that appear and click "I Have Duo Mobile Installed" to continue.
- Follow the Activate Duo Mobile for iOS instructions and click "Continue" once complete. Click the "Save" button. If the button says "Saved" then your settings have been saved.
- Click the "Back to Login" button if you wish to finish logging into the remote.ucsf.edu site, or simply close the web browser since your changes have been saved.
What if I have questions?
Contact the Service Desk at 415-514-4100.
Duo Frequently Asked Questions (FAQs) here
Duo Project information here
Read Duo's documentation here
More information on Yubikeys here
VPN information here
Get help from IT Staff in person at a Health Desk, more information here