it.ucsf.edu

Duo Two-Factor Authentication

Phillip Lunde's picture

To increase security, UCSF requires everyone who uses VPN or who uses Outlook Web (email.ucsf.edu) from a remote location to use Duo two-factor authentication. Two-factor authentication verifies your identity on a separate device (e.g., your smartphone) through a 3rd party application, Duo.

  • All VPN or remote.ucsf.edu users must sign up for Duo by Tuesday, Dec. 5 to avoid disruption of access.
  • All Outlook Web (email.ucsf.edu) users must sign up for Duo by Tuesday, Dec. 12 to avoid disruption of access. Access from mobile email clients is not affected.

Want to learn more about Duo and IT security? Visit it.ucsf.edu/security.

What is Duo?

Duo is a third-party application that UCSF uses for two-factor authentication. Two-factor authentication makes it difficult for others to gain unauthorized access to your account, by requiring a second verification on another device (something you have with you, such as your smartphone).

Duo provides several options for you how you authenticate, but the most convenient is through the Duo Mobile smartphone app (see below).

How Do I Enroll?

If you aren't sure if your account is enrolled in Duo, please follow the Duo Manual Enrollment steps. If you have already received an email titled “Duo Security Enrollment” from “[email protected],” please follow the steps below.

 

Step 1 – Check for Duo enrollment email

Beginning November 20th, UCSF IT will automatically enroll VPN and Outlook Web (email.ucsf.edu) users. Please check your inbox for an email titled “Duo Security Enrollment” from “[email protected].” Receipt of this email means you are automatically enrolled and can simply follow the directions in the email, and skip to step 3 below.

If you did not receive this email, proceed to step 2 below.

Step 2 – Fill out the enrollment form

To confirm your Active Directory (AD) username, or if you have multiple AD username and need to confirm which one is linked to your email, go to https://myaccess.ucsf.edu/myid. Your AD username will be the text in the first tab.

Finding your AD ID

Now go to https://ucsf.service-now.com/ess/duo2factor.do and complete the requested information, including your AD username that is linked to your email account and your domain. Click the "order now" button. Within 24 hours, you will receive an email from “[email protected].”

Step 3 – Download and install the Duo Mobile app 

Note for Zuckerberg San Francisco General Staff only: If you’re using ZSFG's WebConnect, the necessary app is installed on your phone already, and you can use the same Duo Mobile app for UCSF VPN and OWA. To add the UCSF profile to your existing Duo Mobile app, skip to step 4. After you activate your UCSF code, you will see one entry for SF Dept of Public Health, and one entry for UCSF. ZSFG users can skip to step 4.

If you don't already have the Duo Mobile app, click the appropriate link below for your smartphone:

​Or search for “Duo Mobile” in your phone's app store.

Step 4 – Click on link in email

You will get an email from “[email protected]” with instructions for enrolling your AD account in Duo. Follow the instructions in the email in order. To complete enrollment you will need a phone - either a mobile phone that can receive text messages, or a land line. When you click the link to enroll your account in Duo, you will then be prompted to enter your mobile phone number or landline number to perform a one-time activation. Note: If the Service Desk is helping you with this process, you may get a text message with your activation link instead of an email.

Your account is now enrolled in Duo!

Step 5 - VPN users, update your software

You must finish Duo enrollment BEFORE you take this next step, or VPN will not work. 

  1. Go to https://software.ucsf.edu.
    Main page software.ucsf.edu
  2. Scroll down and click “Pulse Secure VPN.”
  3. Pick “Pulse Secure - Dual Authentication” for either Mac or Windows and follow the instructions.
    VPN download page on software.ucsf.edu
  4. Double-click the downloaded package to install Pulse Secure
  5. If using Windows, restart your computer.
  6. Start using Pulse!
    • For Windows, from the Start Menu – Pulse Secure:
      Image of Pulse Software
    • For Mac:
      • From "Applications" - Pulse Secure.App
      • From menu bar, click Pulse Secure icon
        Location of pulse on mac desktop

How do I use Duo once I'm enrolled?

Now when you connect to VPN or Outlook Web Access (OWA), you will be prompted for your second factor authentication. Please see Duo Login Experience and Duo Authentication Methods for more information.

Watch a video on using Duo with a Windows PC below.

 

What if I have questions?

We welcome your questions!