Duo Two-Factor Authentication

Kevin Dale's picture

To increase security, UCSF requires use of Duo two-factor authentication to access certain systems and applications. Two-factor authentication verifies your identity on a separate device (e.g., your smartphone) through a 3rd party application, Duo.

Systems that require Duo include:

  • VPN
  • Outlook Web ( from a remote location (access from mobile email clients is not affected)
  • Connect Portal - Beginning in May/June 2018 doctors and providers who use APeX Connect Portal will be required to use Duo upon logging in with their medical center account. Check back in the coming weeks for more information.
  • ServiceNow - ETA June 2018

What is Duo?

Duo is a third-party application that UCSF uses for two-factor authentication. Two-factor authentication makes it difficult for others to gain unauthorized access to your account, by requiring a second verification on another device (something you have with you, such as your smartphone).

Duo provides several options for you how you authenticate, but the most convenient is through the Duo Mobile smartphone app (see below).

How Do I Enroll?

Step 1 – Check for Duo enrollment email

Please check your inbox for an email titled “Duo Security Enrollment” from “[email protected].” Receipt of this email means you are automatically enrolled and can simply follow the directions in the email, and skip to step 3 below.

If you did not receive this email, proceed to step 2 below.

Step 2 – Fill out the Duo enrollment form

To enroll in Duo, you will need your Active Directory (AD) username to enroll in Duo, or if you have multiple AD usernames, you will need to confirm which one is linked to your email.

Go to Your AD username will be the text in the first tab.

Finding your AD ID

Now go to and complete the requested information, including your AD username that is linked to your email account and your domain.

Click the "order now" button when complete. 

Within 24 hours, you will receive an email from “[email protected].”

If your account shows that it is already enrolled in Duo, please go back to step 1 and search for the Duo enrollment email.

Step 3 – Download and install the Duo Mobile app 

Note for Zuckerberg San Francisco General Staff only: If you’re using ZSFG's WebConnect, the Duo app is installed on your phone already, and you can use it for UCSF systems like VPN and OWA also. Skip to step 4 now to activate your UCSF code.

If you don't already have the Duo Mobile app, click the appropriate link below for your smartphone:

Or search for “Duo Mobile” in your phone's app store.

Step 4 – Click on link in email

You will get an email from “[email protected]” with instructions for enrolling your AD account in Duo. Follow those instructions carefully and in order. To complete enrollment you will need a phone - either a mobile phone that can receive text messages, or a landline. When you click the link to enroll your account in Duo, you will then be prompted to enter your mobile phone number or landline number to perform a one-time activation. Note: If the Service Desk is helping you with this process, you may get a text message with your activation link instead of an email.

Your account is now enrolled in Duo!

How do I use Duo once I'm enrolled?

Now when you connect to applications that require Duo (VPN or Outlook Web Access (OWA) for example), you will be prompted for your second-factor authentication. Please see Duo Login Experience and Duo Authentication Methods for more information.

Watch a video on using Duo with a Windows PC below.


What if I have questions?

We welcome your questions!