DUO Two-Factor Authentication

Kevin Dale's picture

To increase security, UCSF requires everyone who accesses the UCSF network through VPN or uses Outlook web mail from a remote location to use Duo two-factor authentication. Two factor authentication verifies your identity on two separate devices (i.e. your computer and smartphone) through a 3rd party application, Duo.

All VPN or users must sign up for Duo by Tuesday, Dec. 5 to avoid disruption of access.

All Outlook web access users must sign up for Duo by Tuesday, Dec. 12 to avoid disruption of access.

Want to learn more about Duo and IT security? Visit

What is Duo?

Duo is a third-party application that UCSF uses for two-factor authentication, which makes it difficult to gain unauthorized access to an account because access requires a second factor (something you have, such as your smartphone).

To increase security, all users need to log into the University's VPN and OWA with DUO. Duo provides several options for you how you can authenticate, including through a smartphone app, a SMS text message to your cell phone or an automated phone call.

How Do I Enroll?

Automatic enrollment: If you received an email directly from Duo Security with the title "Duo Security Enrollment", this means you are automatically enrolled and can follow the directions in the email.

Manual enrollment: Follow the steps below

Step 1 – Fill out the enrollment form

To confirm your Active Directory login / username, or if you have multiple AD IDs and need to confirm which one is linked to your email, go to Your AD username will be the text in the first tab.

Finding your Active Directory username

Finding your Active Directory username

Now go to and complete the requested information, including your AD ID that is linked to your email account and your domain. Click the "order now" button.


Step 2 – Download and install Duo App 

Note for Zuckerberg San Francisco General Staff only: If you’re using ZSFG's WebConnect, you are one step ahead. The necessary app is installed on your phone already. You will be able to use the same Duo Mobile app on your Droids and iPhones, and enroll the new UCSF QR code to the app. After you activate your UCSF code, you will see one entry for SF Dept of Public Health, and one entry for UCSF. Skip to Step 3.


”Search for “Duo Mobile” in the App Store (iOS) or Google Play store (Android), or click on the appropriate link below from your smartphone:

Within the next 24 hours, you will get an email from Duo with a link in it that you must click to activate your Duo account.

Step 3 – Click on link in email

You will get an email from Duo with a link; click on it to activate Duo. You will then be prompted to enter your smartphone number so that you can use the Duo app. If you do not have one, a regular cell phone or even a landline can work.  You will need access to that phone line when you are trying to use Duo. 

Note: If the Service Desk is helping you with this process, you may get a text message with your activation link instead of an email.

You are now enrolled!

Step 4 - ONLY for people who use Pulse VPN or

DO NOT COMPLETE THIS STEP UNTIL YOU HAVE RECEIVED THE EMAIL FROM STEP 3 AND CLICKED ON IT! You must finish Duo enrollment BEFORE you take this next step or VPN will not work. 

1. Go to

Main page

2. Scroll down and click “Pulse Secure VPN.”

3. Pick “Pulse Secure - Dual Authentication” for either Mac or Windows and follow the instructions.

VPN download page on

4. If using Windows, restart your computer.

5. Start using Pulse!

For Windows, from the Start Menu – Pulse Secure:

Image of Pulse Software

For Mac:

Location of pulse on mac desktop

How do I use Duo once I'm enrolled?

Now when you connect to VPN or Outlook Web Access (OWA), you will be prompted for your second factor authentication. For most people, that will be a 6 digit code from the Duo app on your smartphone.

What if my phone number changes?

Your phone will need to be re-activated by a Duo administrator.  Go to and click on the "Report something that just isn't working right" link.  Fill out the form reporting that your Duo registered phone number has changed and asking that your new number be registered with Duo.

What if I get a new smartphone?

Your new phone will need to be activated.  If you have the same phone number on your new smartphone as you had on your old smartphone, you can activate your new smartphone yourself.

  1. Go to
  2. Login with your Active Directory ID and password.
  3. Click on "Add a new device" on the left side of the Duo authentication prompt.
  4. You'll be asked to authenticate with an existing Duo method.  Choose either "Call Me" or "Enter a Passcode".  Duo's automated system will either call you if you picked "Call Me" or send you a text message if you picked "Enter a Passcode".  If you're being called, follow the directions in the automated phone call to authenticate.  If you're receiving a passcode, enter the passcode you received.
  5. Select "Mobile phone" for the new device type and click "Continue".
  6. Enter your phone number.  When you've finished typing the number, a check box will appear below that says "...This phone number already exists and will be replaced."  Click the check box to enable that option then click the "Continue" button.
  7. Select the type of smartphone you're using and click "Continue"
  8. Follow the Install Duo Mobile for iOS instructions that appear and click "I Have Duo Mobile Installed" to continue.
  9. Follow the Activate Duo Mobile for iOS instructions and click "Continue" once complete.  Click the "Save" button.  If the button says "Saved" then your settings have been saved.
  10. Click the "Back to Login" button if you wish to finish logging into the site, or simply close the web browser since your changes have been saved.

What if I have questions?

Contact the Service Desk at 415-514-4100.

Duo Frequently Asked Questions (FAQs) here

Duo Project information here

Read Duo's documentation here

More information on Yubikeys here

VPN information here

Get help from IT Staff in person at a Health Desk, more information here