Duo Two-Factor Authentication

John Landes's picture

Two-factor authentication verifies your identity on a separate device (e.g., your smartphone) through a 3rd party application known as Duo.

To start using Duo at UCSF

Install the Duo Mobile app on your smartphone. It is the most convenient, easy-to-use option and it's free.

To download the app, click the appropriate link below for your smartphone, or search for "Duo mobile" in your phone's app store:

Systems that require Duo:

  • Connect Portal
  • UCPath
  • VPN (
  • Outlook Web ( when not at UCSF. Access from mobile email clients is not affected.
  • Keeper (Password Vault)
  • Apex for electronic prescription of controlled substances (EPCS)

What is Duo?

Phishing and brute force attacks are increasing exponentially, and so are the risks that your credentials may be stolen. Multi-factor authentication, or MFA, provides added security control..

Multi-factor authentication requires users to provide multiple identifying factors before they will be allowed access to an application or device. We are using a third-party application called Duo to provide two-factor authentication (a subset of multi-factor authentication) for systems such as Remote Access, VPN and Outlook Web Access.

Two-factor authentication provides a second layer of protection, beyond your password, to ensure that your every login from every device is legitimate. This helps us protect you, your work, and the University.

How do I Enroll?

Check your inbox for an email titled "Duo Security Enrollment" from "[email protected]." Receipt of this email means you have been automatically enrolled and can simply follow the directions in the email.

To complete enrollment you will need a phone - either a mobile phone that can receive text messages, or a landline. As you proceed with the steps, you will then be prompted to enter your number to perform a one-time activation. If you do not receive an email for EPCS please contact the Service Desk.

You are now enrolled in Duo!

If you did not receive this email please follow the instructions on our Duo Manual Enrollment or Duo Enrollment on Connect Portal if you are using Apex Connect Portal, manual enrollment is not allowed for EPCS. 

Note to incoming students and staff: If you are accessing your email for the first time and you are not at UCSF, you will be prompted to enroll in Duo when you log in at Follow the on-screen prompts to enroll. If you need assistance please contact the UCSF IT Service Desk.

Note to Zuckerberg San Francisco General staff: If you’re using ZSFG's WebConnect, the Duo app is already installed on your phone. You can use the same app for UCSF systems like VPN and Outlook Web.

How do I use Duo once I'm enrolled?

The most common authentication method is Duo Push. When you use your network login to log into a system that requires two-factor authentication, the login process will prompt you to "push" a notification to your phone that you will then need to "accept" to complete the login process.

For more information please see our Duo Login Experience page for samples of how Duo works with specific applications, and see the Duo Authentication Methods page for all of the different ways you can authenticate with Duo.

What if I have questions?

We welcome your questions!