MFA-Duo - Frequently Asked Questions & Limitations
This document provides references and answers to frequently asked questions about Multi Factor Authentication using Duo.
General MFA-Duo Questions:
Who is eligible to use UW-Madison Duo-Multi Factor Authentication?
Eligible to use Campus funded MFA-Duo license:
This section describes groups who are eligible to enroll in MFA-Duo.
Groups where MFA-Duo enrollment is required are denoted by a *. Other groups in this section are eligible for MFA-Duo, but are not required to enroll. Once someone who is eligible enrolls in MFA-Duo, they are required to use it from that point forward.
- Current UW-Madison employees*
- Those with a current job (between start date and end date) in HRS
- Student employees
- LTEs, Postdoctoral Scholars and Trainees, Honorary Associates/Fellows and Non-Paid positions entered as jobs in HRS ($0 appointments)
- Future UW-Madison employees
- All future employees with a start date any time in the future.
- Current UW-Madison students*
- Those currently enrolled in for-credit classes.
- Future UW-Madison students
- Those eligible to enroll in for-credit classes.
- Current UW-Madison senior guest auditors
- Consultants (POI 14)
- Timecard Approvers (POI 13)
- Emeritus (POI 21)
- Volunteers (POI 22)
- LAB Auditors (POI 26)
- Some additional affiliates
Any group not listed above is not eligible.
- Those without a current job (between start date and end date) in HRS
- Former employees, non-emeritus retirees
- Most Affiliates
- Students not enrolled in for-credit courses
- Former students
- Students enrolled in non-timetable (not for credit) courses
- Non-Madison UW students
- Employees that are not directly working for UW-Madison
- UWSA
- UWSS
- Individual campus
- etc.
See accessibility & usability information
We work with our users to address access and usability barriers in the MFA user experience. Learn details about known access barriers and workarounds at MFA-Duo - Accessibility & Usability Information. If you encounter a barrier or need assistance, please contact the DoIT Help Desk or call (608) 264-4357.
For questions regarding how to get access to the MFA mobile app contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.
How to get access to a Security Key or Duo Token/Fob
Students
Students, to obtain a token/fob, please contact the DoIT Help Desk (608) 264-4357 or email help@doit.wisc.edu. Students with disabilities can also request a token or security key at the McBurney Disability Resource Center, 702 W. Johnson St., Suite #2104, Madison WI 53715 on the 2nd floor.
Faculty, Staff, and Researchers
Employees can get access to devices for MFA at their Human Resources Office or IT department. For questions contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.
Enrolling in MFA Duo using a NetID login account:
Mobile Device Questions:
Reactivating Duo on mobile devices:
-
Navigate to the UW-Madison MFA Portal at MFA.wisc.edu and login with your NetID and password if requested. Once there, click Manage MFA Preferences and Devices.
-
You will see a page that says Manage Your Multi-Factor Authentication (MFA) Devices and prompts you for a MFA-Duo Login. Click the Enter a Passcode option.
If you are currently unable to login to MFA because you do not have another device setup or you do not have a saved list of backup codes, you will need to use a temporary passcode (see MFA-Duo - Request a Temporary Passcode) to continue to step 3 . If you are still able to log into Duo with a device or backup passcode, you can use those instead.
-
Enter the temporary passcode, then press Login.
-
Find the device you wish to re-activate, then click Device Options.
-
Click Reactivate Duo Mobile.
-
Follow the instructions for activating your device by clicking the device you are setting up:
-
Select Mobile phone then press Continue.
-
Enter the phone number of the device. Next, verify this is the correct number of the device by checking the box. Now press Continue.
-
Select the type of phone that the number is associated with (iPhone, Android, or Windows Phone) and press Continue.
-
Download the Duo Mobile Application on the new device you are adding, if not already downloaded:
-
iOS/iPhone: Download the Duo Mobile App from the App Store.
-
Android: Download the Duo Mobile App from the Google Play Store.
-
Windows Phone: Download the Duo Mobile App from the Microsoft Store.
-
-
Configure the Duo App on your mobile device and finish adding the device in MFA Portal:
-
Open the Duo App on your phone.
Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.
-
In the MFA Portal, click I have Duo Mobile installed.
-
In the Duo App on your device, tap the plus sign button.
-
Using your device, scan the QR code on the screen in the MFA Portal and click Continue.
The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment
Note: If you are unable to scan the QR code you can click "Email me an activation link instead" to activate through email
-
-
Select Tablet then press Continue.
-
Select your device type (iOS or Android) and press Continue.
-
Download the Duo Mobile Application for iOS or Android on your tablet, if not already downloaded:
-
iOS: Download the Duo Mobile App from the App Store.
-
Android: Download the Duo Mobile App from the Google Play Store.
-
- Configure the Duo App on your tablet and finish adding the device in MFA Portal:
-
Open the Duo App on your tablet.
Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.
-
In the MFA Portal, click I have Duo Mobile installed.
-
In the Duo App on your device, tap the plus sign button.
-
Using your device, scan the QR code on the screen in the MFA Portal and click Continue.
The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment
Note: If you are unable to scan the QR code you can click "Email me an activation link instead" to activate through email
-
We work with our users to address access and usability barriers in the MFA user experience. Learn details about known access barriers and workarounds at
MFA-Duo - Accessibility & Usability Information.
If you encounter a barrier or need assistance, please contact the DoIT Help Desk or call (608) 264-4357. For questions regarding how to get access to the MFA mobile app contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.
Students, to obtain a token/fob, please contact the DoIT Help Desk (608) 264-4357 or email help@doit.wisc.edu. Students with disabilities can also request a token or security key at the McBurney Disability Resource Center, 702 W. Johnson St., Suite #2104, Madison WI 53715 on the 2nd floor. Employees can get access to devices for MFA at their Human Resources Office or IT department. For questions contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu. See accessibility & usability information
How to get access to a Security Key or Duo Token/Fob
Students
Faculty, Staff, and Researchers
Setting up Duo for the first time on mobile devices:
Note: This document is only for setup if you're planning to use a smartphone or tablet with MFA Duo.
- If you're planning to use a token only, see MFA-Duo - First Time Setup for Token/Fob .
- If you need help reactivating duo on a new device, see MFA Duo – Reactivate Duo on a Mobile Device
Background:
UW-Madison has selected Duo as our solution for Multi-factor Authentication. In order to utilize Multi-factor authentication, you will need to set it up on a smartphone, tablet or token.
More on the Duo Multi-factor Authentication Project can be found on here: MFA-Duo - What is Duo Multi-factor Authentication?.
Items needed for First Time Setup:
- Smartphone or tablet running supported platform.
- Smartphone or tablet connected to Wi-Fi or cellular data network.
- Separate device with a web browser (not the smartphone or tablet you are registering).
- Duo Mobile App. You will be prompted to download this free application during the setup process.
First Time Setup Process for smartphone or tablet:
- Open a browser on a device other than the smartphone/tablet you are trying to register.
- Navigate to www.mfa.wisc.edu. When prompted, authenticate with your NetID and password.
- Click on Register Smartphone or Tablet
- Click the Start setup button.
Select the device type you would like to add.
Select Mobile Phone then press Continue.
Enter the phone number of the device. Next, verify this is the correct number of the device by checking the box. Now press Continue.
Select the type of phone that the number is associated with and press Continue.
-
Download the Duo Mobile Application for your device:
iOS/iPhone: Download the Duo Mobile App from the App Store.
Android: Download the Duo Mobile App from the Google Play Store.
Windows Phone: Download the Duo Mobile App from the Microsoft Store.
Configure the Duo App on your mobile device and finish adding the device in MFA Portal:
Open the Duo App on your phone.
Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.
In the MFA Portal, click I have Duo Mobile installed.
In the Duo App on your device, tap the plus sign button in the top right.
Using your device, scan the QR code on the screen in the MFA Portal and click Continue.
The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment
- You will see the following screen in your browser if your first device registration is successful, and your mobile phone should return to the Duo home screen. You will be prompted to start using MFA within one day.
Select Tablet then press Continue.
Select iOS or Android (depending on your device) then press Continue.
Download the Duo Mobile Application for iOS or Android:
iOS: Download the Duo Mobile App from the App Store.
Android: Download the Duo Mobile App from the Google Play Store.
Configure the Duo App on your tablet and finish adding the device in MFA Portal:
Open the Duo App on your tablet.
Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.
In the MFA Portal, click I have Duo Mobile installed.
In the Duo App on your tablet, tap the plus sign button in the top right.
Using your device, scan the QR code on the screen in the MFA Portal and click Continue.
The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment
- You will see the following screen in your browser if your first device registration is successful, and your tablet should return to the Duo home screen. You will be prompted to start using MFA within one day.
Optional - To set your default login settings, see
- UW-Madison encourages users to add multiple devices in the event that they lose access to a single device. Instructions for adding devices can be found here:
MFA-Duo - Adding Secondary/Backup Devices
MFA-Duo - Generating Backup Passcodes for Future Use
See accessibility & usability information
We work with our users to address access and usability barriers in the MFA user experience. Learn details about known access barriers and workarounds at MFA-Duo - Accessibility & Usability Information. If you encounter a barrier or need assistance, please contact the DoIT Help Desk or call (608) 264-4357.
For questions regarding how to get access to the MFA mobile app contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.
How to get access to a Security Key or Duo Token/Fob
Students
Students, to obtain a token/fob, please contact the DoIT Help Desk (608) 264-4357 or email help@doit.wisc.edu. Students with disabilities can also request a token or security key at the McBurney Disability Resource Center, 702 W. Johnson St., Suite #2104, Madison WI 53715 on the 2nd floor.
Faculty, Staff, and Researchers
Employees can get access to devices for MFA at their Human Resources Office or IT department. For questions contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.
Adding a secondary/backup device:
Note: If you are registering a new primary device and no longer have access to your currently-registered device, see MFA Duo – Reactivate Duo on a Mobile Device.
Adding another device:
Navigate to the Multi-Factor Authentication Portal at www.mfa.wisc.edu. Authenticate with your UW-Madison NetID and Password. authentication devices.
Click Manage MFA Preferences and Devices.
- Note: You will need to authenticate using an existing multi-factor authentication device.
Click Add Another Device.
-
Follow the instructions specific to the device type you would like to add.
Select Mobile phone then press Continue.
Enter the phone number of the device. Next, verify this is the correct number of the device by checking the box. Now press Continue.
Select the type of phone that the number is associated with (iPhone, Android, or Windows Phone) and press Continue.
-
Download the Duo Mobile Application on the new device you are adding, if not already downloaded:
iOS/iPhone: Download the Duo Mobile App from the App Store.
Android: Download the Duo Mobile App from the Google Play Store.
Windows Phone: Download the Duo Mobile App from the Microsoft Store.
-
Configure the Duo App on your mobile device and finish adding the device in MFA Portal:
Open the Duo App on your phone.
Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.
In the MFA Portal, click I have Duo Mobile installed.
In the Duo App on your device, tap the plus sign button.
Using your device, scan the QR code on the screen in the MFA Portal and click Continue.
The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment
Select Tablet then press Continue.
Select your device type (iOS or Android) and press Continue.
Download the Duo Mobile Application for iOS or Android on your tablet, if not already downloaded:
iOS: Download the Duo Mobile App from the App Store.
Android: Download the Duo Mobile App from the Google Play Store.
- Configure the Duo App on your tablet and finish adding the device in MFA Portal:
Open the Duo App on your tablet.
Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.
In the MFA Portal, click I have Duo Mobile installed.
In the Duo App on your device, tap the plus sign button.
Using your device, scan the QR code on the screen in the MFA Portal and click Continue.
The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment
Go to https://go.wisc.edu/token.
Log in with your NetID and password.
Note: If you've already registered a device and are using MFA Duo, you'll be prompted to login with your NetID twice, then be prompted for MFA Duo.
Select the type of token that you have.
Enter the Token Serial Number in the appropriate field. The Token Serial Number may be entered with spaces/dashes or with numbers only; the format does not matter.
Making sure that the token's button is oriented to the left, press the button on the front of the token and enter the 6-digit passcode.
Click Register Duo Token/Fob.
The token will now be registered with your account.
Please note, if the token is the first MFA device you have registered, you'll will start being prompted for MFA.
Please note that one of the token images resembles a Yubikey token. Yubikey tokens are not supported by the UW Madison MFA project.
Note: You will need to obtain a token before you can register it. For information on how to obtain a token, see MFA-Duo - What is a token/fob?. It is very important that you not press the token button repeatedly prior to registering your token. This may cause the token to become out of sync and you will not be able to register it.See accessibility & usability information
We work with our users to address access and usability barriers in the MFA user experience. Learn details about known access barriers and workarounds at MFA-Duo - Accessibility & Usability Information. If you encounter a barrier or need assistance, please contact the DoIT Help Desk or call (608) 264-4357.
For questions regarding how to get access to the MFA mobile app contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.
How to get access to a Security Key or Duo Token/Fob
Students
Students, to obtain a token/fob, please contact the DoIT Help Desk (608) 264-4357 or email help@doit.wisc.edu. Students with disabilities can also request a token or security key at the McBurney Disability Resource Center, 702 W. Johnson St., Suite #2104, Madison WI 53715 on the 2nd floor.
Faculty, Staff, and Researchers
Employees can get access to devices for MFA at their Human Resources Office or IT department. For questions contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.
Login to the MFA Portal.
Click Register Token/Fob or USB Security Key.
Click USB Security Key.
Enter the serial number, found on the back of the USB device. Plug the device into a USB port, and tap the button on the device to enter a six-digit passcode into the field under Step 3.
In the lower window, authenticate to duo using your USB token. Then click +Add another device. Select Security Key.
Click Continue to bring up a popup window for enrolling your security key. The key will need to be plugged into a USB port on your computer.
Tap the button on your device to complete enrollment.
MFA only supports the U2F authentication method in the Google Chrome browser, so we highly recommend you use the U2F feature as a SECONDARY authentication method and have at least one other device enrolled.
If run into any issues or have any questions, please contact the DoIT Help Desk.
The security key allows MFA-Duo users to insert the security key into the USB port of their computer or laptop to authenticate. This security key requires a reachable USB port, but this security key also works with a laptop or desktop USB to USB-C adaptor. The key is not compatible with mobile devices and only works with laptop or desktop computers.
The security key experience is slightly different for the following modes of logging in. See below for details on these modes.
Chrome web browser login
When logging in to a UW-Madison website or apps using Chrome (version 70 or later), insert the security key into your USB port, select Security Key (U2F) from the device dropdown menu, and lightly touch the impressed sensor button to initiate login.
Non-Chrome web browser or local software login
When logging into a UW-Madison website or app in Firefox or Safari, insert the security key into your USB port. Select Token from the device dropdown menu, and click the "Enter passcode" button to make the passcode input field editable. Then lightly touch the impressed sensor button to insert the passcode in the input field. If you are using a screen reader or other assistive technology, the security key may enter the passcode so quickly you may not hear the full code. The audio cue may only include the last digit of the code. Click the login button to complete authentication, as the full code should have populated the field.
(See How to use a Feitian USB Security Key for more details and screenshots on the Chrome web browser login.)
How to get a security key
Faculty and Staff New staff: get a Feitian security key from your HR representative. Feitian security keys can also be picked up at the Walk-In Help Desk at 1210 W. Dayton Street Madison, WI 53706. Current staff can get a Feitian security key at the Walk-In Help Desk at 1210 W. Dayton Street Madison, WI 53706.
Students: Get a token or security key at no charge, at either the Walk-in Help Desk at 1210 W. Dayton St. or the pop-up Help Desks from early September through October 31, 2019. Locations and times for the pop-up Help Desks will be posted on the UW-Madison Events Calendar soon. After October 31, tokens or security keys can be picked up at the Walk-In Help Desk at 1210 W. Dayton St. For other assistance, contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.
See accessibility & usability information
We work with our users to address access and usability barriers in the MFA user experience. Learn details about known access barriers and workarounds at MFA-Duo - Accessibility & Usability Information. If you encounter a barrier or need assistance, please contact the DoIT Help Desk or call (608) 264-4357.
For questions regarding how to get access to the MFA mobile app contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.
How to get access to a Security Key or Duo Token/Fob
Students
Students, to obtain a token/fob, please contact the DoIT Help Desk (608) 264-4357 or email help@doit.wisc.edu. Students with disabilities can also request a token or security key at the McBurney Disability Resource Center, 702 W. Johnson St., Suite #2104, Madison WI 53715 on the 2nd floor.
Faculty, Staff, and Researchers
Employees can get access to devices for MFA at their Human Resources Office or IT department. For questions contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.
At the portal screen, you should now see the device you have registered listed. The device has been registered successfully!
Note: If the device does not register or show up in the list of devices, try adding the device again. If it fails again, contact the DoIT Help Desk for assistance.
See accessibility & usability information
We work with our users to address access and usability barriers in the MFA user experience. Learn details about known access barriers and workarounds at MFA-Duo - Accessibility & Usability Information. If you encounter a barrier or need assistance, please contact the DoIT Help Desk or call (608) 264-4357.
For questions regarding how to get access to the MFA mobile app contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.
How to get access to a Security Key or Duo Token/Fob
Students
Students, to obtain a token/fob, please contact the DoIT Help Desk (608) 264-4357 or email help@doit.wisc.edu. Students with disabilities can also request a token or security key at the McBurney Disability Resource Center, 702 W. Johnson St., Suite #2104, Madison WI 53715 on the 2nd floor.
Faculty, Staff, and Researchers
Employees can get access to devices for MFA at their Human Resources Office or IT department. For questions contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.
How many devices can I use with Duo?
- 100 phones per use
- 100 OTP tokens per user ⢠100 U2F tokens per user
More details can be found here: Duo Docs - What are the one-to-many object limits in Duo?
Managing MFA device settings:
Note: This document is intended for use after you have already registered at least 1 device (smartphone, tablet or token). If you have not yet registered a device, see MFA-Duo - How to Enroll for MFA Duo for your NetID Login Account
Accessing the Multi-Factor Authentication Portal
- To access the Multi-Factor Authentication Portal, navigate to www.mfa.wisc.edu log in with your NetID and password.
- Click on Manage MFA Preferences & Devices.
- You will be prompted to use MFA to authenticate at this point.
- You will now see the My Settings & Devices page which lists the devices that you have already registered for MFA.
- Clicking Device Options button next to the device presents a list of available options for the device.
- Reactivate Duo Mobile (Smartphone, Tablet): Allows you to complete the setup of Duo Mobile on a device if the app was uninstalled or you received a new smartphone or tablet.
- Change Device Name (Smartphone, Tablet): Allows you to change the name of the device.
- Red Trash Icon (Smartphone, Tablet, Token): Allows you to remove the device from your approved devices.
- Note: if you have only one MFA device registered, you will not see the Red Trash Icon.

Add Another Device (Recommended)
UW-Madison encourages users to add multiple devices in the event that they lose access to a single device.
To add another device, follow the instructions here: MFA-Duo - Adding Secondary/Backup Devices.
Default Device Settings
- Default Device: Allows you to pick the default device that you log in with.
- When I log in Allows you to select the default authentication method. UW-Madison recommends you do NOT select 'Automatically send this device a Duo Push'. If you select to automatically send a push to this device, you will not have the opportunity to select 'remember me for 12 hours' during the initial login push.
More on default devices can be found here: MFA-Duo - Setting a Default Login Device
See accessibility & usability information
We work with our users to address access and usability barriers in the MFA user experience. Learn details about known access barriers and workarounds at MFA-Duo - Accessibility & Usability Information. If you encounter a barrier or need assistance, please contact the DoIT Help Desk or call (608) 264-4357.
For questions regarding how to get access to the MFA mobile app contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.
How to get access to a Security Key or Duo Token/Fob
Students
Students, to obtain a token/fob, please contact the DoIT Help Desk (608) 264-4357 or email help@doit.wisc.edu. Students with disabilities can also request a token or security key at the McBurney Disability Resource Center, 702 W. Johnson St., Suite #2104, Madison WI 53715 on the 2nd floor.
Faculty, Staff, and Researchers
Employees can get access to devices for MFA at their Human Resources Office or IT department. For questions contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.
When do Duo Push authentication attempts expire?
This isn't time is not configurable.
What to do if you aren't receiving push notifications on your device:
There are two main reasons you may not receive push notifications from Duo on your phone:
- Notifications are not enabled.
- Unstable cellular/data/wifi connection on your phone.
Follow the steps below to resolve this issue:
Duo Push delivery issues are most often resolved by pulling down on the screen to check for notifications in the Duo Mobile app:
When you do this, the Duo Mobile application will reach out to the Duo cloud service directly to check for login requests rather than using the push notification services. This is generally the most reliable way of receiving a login request and should work if the app and account are functioning properly.
If push works by manually pulling to refresh but notifications are not received, it is most likely because you selected not to receive notifications when installing the application.
To check if push notifications are enabled for Duo Mobile, and re-enable them if needed, follow these steps:
On the iPhone, open Settings.
Scroll down and select Duo Mobile.
Select Notifications.
If "Allow Notifications" box is already checked, uncheck and then re-check it. If it was not yet checked, check it. Verify that notifications are configured how you want them.
Fully close (double-tap home button and swipe up) Duo Mobile.
Open Duo Mobile again.
Duo Push delivery issues are most often resolved by pulling down on the screen to check for notifications in the Duo Mobile app:

When you do this, the Duo Mobile application will reach out to the Duo cloud service directly to check for login requests rather than using the push notification services. This is generally the most reliable way of receiving a login request and should work if the app and account are functioning properly.
If pull to refresh works
If manually checking works, then the issue is related to the Google Cloud Messaging (GCM) push notification service and Duo Mobile registering for pushes correctly. This will often fix itself after you pull-to-refresh. Sometimes there are issues with GCM on the device, like out-of-date play services, that prevent the device from receiving push notifications properly, you should update Google Play Services if possible to alleviate this.
If it's an issue with the long-lived connection to GCM on the device, toggling Wi-Fi off and back on may fix the issue.
Clearing the Duo Mobile application cache can also resolve delivery issues.
Open Settings.
Select Apps and scroll down to select Duo Mobile.
On the App Info page, tap Clear Cache.
If checking for and enabling notifications doesn't resolve your issue, the problem is most likely due to an unstable celluar/data/wifi connection on your phone. In this case, use the Duo Mobile app to generate a passcode: MFA-Duo - Obtaining a Passcode from the Duo Mobile App.
Example error messages you may receive when due to an unstable cellular/data/wifi connection on your phone:What should you do when changing SIM card/phone number/phone?
Changing SIM Card
Changing your SIM card will not affect the way you authenticate (even if it changes your phone number) because the Duo Mobile app is tied to your smartphone's hardware security module (HSM). You should still be able to accept a push or generate a passcode from the Duo Mobile app (even when your smartphone is in airplane mode or lacks cell/ wi-fi service).
To generate a passcode:
- Simply open the Duo Mobile app and click the UW Madison NetID Login down arrow located at the upper right-hand corner of your smartphone. This will generate a six-digit temporary passcode.
- Enter the six-digit code provided on your smartphone in the Multi-Factor Authentication portal to complete the authentication process.
Permanently Changing Phone Number
Assuming the user still has Duo Mobile installed and the ability to authenticate via push or a passcode, they should follow the procedure for adding a new device. See MFA-Duo - Adding Secondary/Backup Devices
If they do not have any means of authenticating they
should contact their help desk. We recommend deleting the old device as soon as possible, see MFA-Duo - Removing Devices
Changing Phone
Since Duo Mobile is tied to a specific device's HSM, the user will need to reinstall and reactivate Duo Mobile on their new phone. See MFA-Duo - First Time Setup for Smartphone or Tablet
Changing Phone, Keeping same phone number
In this scenario, you will simply need to reactivate Duo Mobile for your new phone by visiting mfa.wisc.edu.
Login with your NetID and password.
Click Manage MFA Preferences and Devices.
You will be prompted for MFA. If you do not have access to your previously registered phone, you will need to get a temporary code to be able to access the Multi-Factor Authentication Portal. See MFA-Duo - Request a Temporary Passcode
Click the Device Options button next to your previously registered phone.
Click Reactivate Duo Mobile.
Install Duo Mobile on your new phone.
Click I have Duo Mobile Installed.
Follow the onscreen prompts to scan the QR code.
Your phone should now be reactivated and ready for use with MFA Duo.
See accessibility & usability information
We work with our users to address access and usability barriers in the MFA user experience. Learn details about known access barriers and workarounds at MFA-Duo - Accessibility & Usability Information. If you encounter a barrier or need assistance, please contact the DoIT Help Desk or call (608) 264-4357.
For questions regarding how to get access to the MFA mobile app contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.
How to get access to a Security Key or Duo Token/Fob
Students
Students, to obtain a token/fob, please contact the DoIT Help Desk (608) 264-4357 or email help@doit.wisc.edu. Students with disabilities can also request a token or security key at the McBurney Disability Resource Center, 702 W. Johnson St., Suite #2104, Madison WI 53715 on the 2nd floor.
Faculty, Staff, and Researchers
Employees can get access to devices for MFA at their Human Resources Office or IT department. For questions contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.
Token, Fob, and USB Security Key Questions:
What is a token/fob?


If you need a MFA token/fob, please contact your human resources or IT department, or visit the DoIT Help Desk.
Who pays for MFA tokens/fobs?
How do I register my MFA token/fob?
How do I use my MFA token/fob?
Registering a token/fob:
Go to https://go.wisc.edu/token.
Log in with your NetID and password.
Note: If you've already registered a device and are using MFA Duo, you'll be prompted to login with your NetID twice, then be prompted for MFA Duo.
Select the type of token that you have.
Enter the Token Serial Number in the appropriate field. The Token Serial Number may be entered with spaces/dashes or with numbers only; the format does not matter.
Making sure that the token's button is oriented to the left, press the button on the front of the token and enter the 6-digit passcode.
Click Register Duo Token/Fob.
The token will now be registered with your account.
Please note, if the token is the first MFA device you have registered, you'll will start being prompted for MFA.
Registering a U2F USB Security Key:
MFA only supports the U2F authentication method in the Google Chrome browser, so we highly recommend you use the U2F feature as a SECONDARY authentication method and have at least one other device enrolled.
Login to the MFA Portal.
Click Register Token/Fob or USB Security Key.
Click USB Security Key.
Enter the serial number, found on the back of the USB device. Plug the device into a USB port, and tap the button on the device to enter a six-digit passcode into the field under Step 3.
In the lower window, authenticate to duo using your USB token. Then click +Add another device. Select Security Key.
Click Continue to bring up a popup window for enrolling your security key. The key will need to be plugged into a USB port on your computer.
Tap the button on your device to complete enrollment.
If run into any issues or have any questions, please contact the DoIT Help Desk.
The security key allows MFA-Duo users to insert the security key into the USB port of their computer or laptop to authenticate. This security key requires a reachable USB port, but this security key also works with a laptop or desktop USB to USB-C adaptor. The key is not compatible with mobile devices and only works with laptop or desktop computers.
The security key experience is slightly different for the following modes of logging in. See below for details on these modes.
Chrome web browser login
When logging in to a UW-Madison website or apps using Chrome (version 70 or later), insert the security key into your USB port, select Security Key (U2F) from the device dropdown menu, and lightly touch the impressed sensor button to initiate login.
Non-Chrome web browser or local software login
When logging into a UW-Madison website or app in Firefox or Safari, insert the security key into your USB port. Select Token from the device dropdown menu, and click the "Enter passcode" button to make the passcode input field editable. Then lightly touch the impressed sensor button to insert the passcode in the input field. If you are using a screen reader or other assistive technology, the security key may enter the passcode so quickly you may not hear the full code. The audio cue may only include the last digit of the code. Click the login button to complete authentication, as the full code should have populated the field.
(See How to use a Feitian USB Security Key for more details and screenshots on the Chrome web browser login.)
How to get a security key
Faculty and Staff New staff: get a Feitian security key from your HR representative. Feitian security keys can also be picked up at the Walk-In Help Desk at 1210 W. Dayton Street Madison, WI 53706. Current staff can get a Feitian security key at the Walk-In Help Desk at 1210 W. Dayton Street Madison, WI 53706.
Students: Get a token or security key at no charge, at either the Walk-in Help Desk at 1210 W. Dayton St. or the pop-up Help Desks from early September through October 31, 2019. Locations and times for the pop-up Help Desks will be posted on the UW-Madison Events Calendar soon. After October 31, tokens or security keys can be picked up at the Walk-In Help Desk at 1210 W. Dayton St. For other assistance, contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.
What if my token/fob stops working?
Note: This document is intended for tokens that have already been registered with your account. If you have not yet registered your token, see MFA-Duo - How to Register a Token/Fob
Incorrect Passcode Errors
Your token can get "out of sync" if the button is pressed too many times in a row and the generated passcodes aren't used for login.
If this happens to your token, you will see the error message above when attempting to log in. Your token can get "out of sync" by accident if it is stored next to other objects in a pocket, backpack, etc. or if the button is intentionally pressed repeatedly. There are two ways to resynchronize your token/fob.
Method One
To resynchronize your token/fob using the first method, follow the steps below:
Log in with your NetID and password to the Duo Device Management Portal and click on Resynchronize Token/Fob or USB Security Key.
Making sure that the token's button is oriented to the left, press the button to generate three distinct passcodes and enter each into one of the blank fields. Click Resynchronize Device.
Method Two
To resynchronize your token/fob using the second method, generate three passcodes in a row and attempt to log in with each passcode. You'll need to delete the passcode from the entry field before generating the next passcode and attempting to log in. On the fourth attempt, you should be able to log in.
If your token still doesn't allow you to authenticate after trying both resynchronization methods, please call the DoIT Help Desk at (608) 264-HELP (4357).
Token Display No Longer Works
This is an indication that the token's battery has died. Since the batteries cannot be replaced, you'll need to obtain a replacement token. Contact your human resources department, IT department, or visit the DoIT Help Desk on Dayton Street to get a new token.
Token Displaying Unusual Characters, Generating Unusual Passwords, or Displaying the Same Code Repeatedly
This is an indication that the token has malfunctioned. You'll need to obtain a replacement token. Contact your human resources department, IT department, or visit the DoIT Help Desk on Dayton Street to get a new token.
Using Feitian USB security keys and compatibility:
The security key allows MFA-Duo users to insert the security key into the USB port of their computer or laptop to authenticate. This security key requires a reachable USB port, but this security key also works with a laptop or desktop USB to USB-C adaptor. The key is not compatible with mobile devices and only works with laptop or desktop computers.
The security key experience is slightly different for the following modes of logging in. See below for details on these modes.
Chrome web browser login
When logging in to a UW-Madison website or apps using Chrome (version 70 or later), insert the security key into your USB port, select Security Key (U2F) from the device dropdown menu, and lightly touch the impressed sensor button to initiate login.
Non-Chrome web browser or local software login
When logging into a UW-Madison website or app in Firefox or Safari, insert the security key into your USB port. Select Token from the device dropdown menu, and click the "Enter passcode" button to make the passcode input field editable. Then lightly touch the impressed sensor button to insert the passcode in the input field. If you are using a screen reader or other assistive technology, the security key may enter the passcode so quickly you may not hear the full code. The audio cue may only include the last digit of the code. Click the login button to complete authentication, as the full code should have populated the field.
(See How to use a Feitian USB Security Key for more details and screenshots on the Chrome web browser login.)
How to get a security key
Faculty and Staff New staff: get a Feitian security key from your HR representative. Feitian security keys can also be picked up at the Walk-In Help Desk at 1210 W. Dayton Street Madison, WI 53706. Current staff can get a Feitian security key at the Walk-In Help Desk at 1210 W. Dayton Street Madison, WI 53706.
Students: Get a token or security key at no charge, at either the Walk-in Help Desk at 1210 W. Dayton St. or the pop-up Help Desks from early September through October 31, 2019. Locations and times for the pop-up Help Desks will be posted on the UW-Madison Events Calendar soon. After October 31, tokens or security keys can be picked up at the Walk-In Help Desk at 1210 W. Dayton St. For other assistance, contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.
How to perform first time setup for tokens and fobs:
Note: This document is only for setup if you're planning to use a token instead of a smartphone/tablet with MFA Duo. If you're planning to use a smartphone/tablet, see MFA-Duo - First Time Setup for Smartphone or Tablet.
UW-Madison has selected Duo Multi-factor Authentication as our solution for Multi-factor Authentication. In order to utilize Multi-factor authentication, you will need to set it up on a smartphone or tablet.
More on the Duo Multi-factor Authentication Project can be found on the MFA-Duo Authentication Project's website.
First Token
Instructions for setting up your first token can be found here: MFA-Duo - How to Register a Token/Fob.
Additional Tokens/Devices
UW-Madison encourages users to add multiple devices in the event that they lose access to a single device. Instructions for adding devices can be found here:
What to do when you found a lost token/fob?
Return lost tokens/fobs to the DoIT Help Desk as soon as possible.
Passcode Questions:
Generating a backup passcode:
Note: You will need to be able to authenticate with Duo in order to reach the page to generate backup passcodes. If you currently cannot sign into Duo, try generating a temporary passcode (see MFA-Duo - Request a Temporary Passcode).
Generating Backup Passcodes for Future Use
- Navigate to the Multi-Factor Authentication Portal at www.mfa.wisc.edu. Authenticate with your UW-Madison NetID and Password. You will also be asked to approve the login through your existing multi-factor authentication devices.
- Click the blue Create Backup Passcodes button.
- Click the blue Print Backup Passcodes button.
- Click Print to print your passcodes or write them down if you do not have access to a printer
Handling Your Backup Codes
- Backup codes should be stored in a secure but accessible location (such as a locked drawer or cabinet) while not in use.
- Generating new backup codes will invalidate your previous backup codes.
- Backup codes will expire after four months; The expiration date is displayed on the print-out below the passcodes.
- Each code can only be used once so we recommend crossing them off as you use them.
Requesting a temporary passcode:
-
Log in with your NetID and password to the MFA-Duo Temporary Passcode Request application at: https://login.wisc.edu/duo-recovery.
-
Answer the security questions and click Next (these are the same security questions you set up for your NetID):
-
Once your temporary passcode is generated, click Copy or take note of your temporary passcode:
-
You may use this code for 12 hours to login via MFA-Duo. Be sure to select Enter a Passcode at the MFA-Duo prompt and enter your passcode.
-
If you're trying to use this code to add a new MFA device, see: MFA-Duo - Adding Secondary/Backup Devices
Obtaining a passcode from Duo Mobile app:
- At the MFA Duo prompt, select Enter a Passcode.
- Open the Duo Mobile app on your device.
- Click the UW Madison item in your app.
- A 6-digit passcode will be presented. Enter that passcode in the MFA Duo prompt to complete the login process.


- If the code doesn't work, click the refresh icon next to the code to generate a new code.
- The code below is simply an example and not to be used to login.
