MFA-Duo - Best Practices for Using Duo

This document will highlight the best practices for using MFA Duo.

1. Register more than 1 device or generate backup codes for future use

If you've ever been in a situation where you don't have your MFA device with you, you know this can be a major inconvenience. Give yourself some options ahead of time so you don't get into a bind:

Generating Backup Passcodes for Future Use

  1. Navigate to the Multi-Factor Authentication Portal at www.mfa.wisc.edu. Authenticate with your UW-Madison NetID and Password. You will also be asked to approve the login through your existing multi-factor authentication devices.
  2. Click the green Backup Passcodes button.
  3. backup_passcodes.PNG

  4. Click the green Get New Backup Passcodes button.
  5. backup_passcodes_get.PNG

  6. Click the green Print Backup Passcodes button.
  7. backup_passcodes_print.PNG

  8. Click Print to print your passcodes or write them down if you do not have access to a printer
  9. BUP-004-Print.png


Handling Your Backup Codes

  • Backup codes should be stored in a secure but accessible location (such as a locked drawer or cabinet) while not in use.
  • Generating new backup codes will invalidate your previous backup codes.
  • Backup codes will expire after four months; The expiration date is displayed on the print-out below the passcodes.
  • Each code can only be used once so we recommend crossing them off as you use them.

Adding another device:

  1. Navigate to the Multi-Factor Authentication Portal at www.mfa.wisc.edu. Authenticate with your UW-Madison NetID and Password. authentication devices.

  2. Click Manage MFA Preferences and Devices.

    • Note: You will need to authenticate using an existing multi-factor authentication device.
  3. Click Add Another Device.

    my_devices.PNG

  4. Follow the instructions specific to the device type you would like to add.

    1. Select Mobile phone then press Continue.

      device_type_mobile.PNG

    2. Enter the phone number of the device. Next, verify this is the correct number of the device by checking the box. Now press Continue.

      3AddPhoneNumber(cropped).png

    3. Select the type of phone that the number is associated with (iPhone, Android, or Windows Phone) and press Continue.

    4. Download the Duo Mobile Application on the new device you are adding, if not already downloaded:

    5. Configure the Duo App on your mobile device and finish adding the device in MFA Portal:

      1. Open the Duo App on your phone.

        Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.

      2. In the MFA Portal, click I have Duo Mobile installed.

        4DownloadandorConfirmDuoMobileAppInstalledonPhoneorTablet(cropped).png

      3. In the Duo App on your device, tap the plus sign button.

      4. Using your device, scan the QR code on the screen in the MFA Portal and click Continue.

        The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment

        5SuccessfulQRCodeScanforPhoneorTablet(cropped).png

    1. Select Tablet then press Continue.

      device_type_tablet.PNG

    2. Select your device type (iOS or Android) and press Continue.

    3. Download the Duo Mobile Application for iOS or Android on your tablet, if not already downloaded:

    4. Configure the Duo App on your tablet and finish adding the device in MFA Portal:
      1. Open the Duo App on your tablet.

        Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.

      2. In the MFA Portal, click I have Duo Mobile installed.

        4DownloadandorConfirmDuoMobileAppInstalledonPhoneorTablet(cropped).png

    5. In the Duo App on your device, tap the plus sign button.

    6. Using your device, scan the QR code on the screen in the MFA Portal and click Continue.

      The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment

      5SuccessfulQRCodeScanforPhoneorTablet(cropped).png

      Note: You will need to obtain a token before you can register it. For information on how to obtain a token, see MFA-Duo - What is a token/fob?. It is very important that you not press the token button repeatedly prior to registering your token. This may cause the token to become out of sync and you will not be able to register it.
      1. Go to https://go.wisc.edu/token.

      2. Log in with your NetID and password.

      • Note: If you've already registered a device and are using MFA Duo, you'll be prompted to login with your NetID twice, then be prompted for MFA Duo.

    • Select the type of token that you have.

      register_fob_key.PNG

    • Enter the Token Serial Number in the appropriate field. The Token Serial Number may be entered with spaces/dashes or with numbers only; the format does not matter.

    • Making sure that the token's button is oriented to the left, press the button on the front of the token and enter the 6-digit passcode.

    • Click Register Duo Token/Fob.

    • The token will now be registered with your account.

    • Please note, if the token is the first MFA device you have registered, you'll will start being prompted for MFA.

      MFA only supports the U2F authentication method in the Google Chrome browser, so we highly recommend you use the U2F feature as a SECONDARY authentication method and have at least one other device enrolled.

      1. Login to the MFA Portal.

      2. Click Manage MFA Preferences and Devices.

        section of MFA portal with a button that reads Manage MFA Preferences and Devices.

      3. Authenticate using MFA.

      4. Click +Add another device to begin the registration process.

      5. Select Security Key from the device types. Click Continue.

        selection of device types: mobile phone, tablet, and security key - referenced in step 5.

      6. Click Continue to bring up a popup window for enrolling your security key. The key will need to be plugged into a USB port on your computer.

        the options Back and Continue which will appear after selecting Security Key from the device types.

        pop-up window that appears after clicking continue on the previous screen, prompting the user to insert the security key into a USB port and to tap the button.

      7. Tap the button on your device to complete enrollment.


      If run into any issues or have any questions, please contact the DoIT Help Desk.

  5. The device has been added. You should now see it in the Multi-Factor Authentication Portal.

Adding another device:

  1. Navigate to the Multi-Factor Authentication Portal at www.mfa.wisc.edu. Authenticate with your UW-Madison NetID and Password. authentication devices.

  2. Click Manage MFA Preferences and Devices.

    • Note: You will need to authenticate using an existing multi-factor authentication device.
  3. Click Add Another Device.

    my_devices.PNG

  4. Follow the instructions specific to the device type you would like to add.

    1. Select Mobile phone then press Continue.

      device_type_mobile.PNG

    2. Enter the phone number of the device. Next, verify this is the correct number of the device by checking the box. Now press Continue.

      3AddPhoneNumber(cropped).png

    3. Select the type of phone that the number is associated with (iPhone, Android, or Windows Phone) and press Continue.

    4. Download the Duo Mobile Application on the new device you are adding, if not already downloaded:

    5. Configure the Duo App on your mobile device and finish adding the device in MFA Portal:

      1. Open the Duo App on your phone.

        Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.

      2. In the MFA Portal, click I have Duo Mobile installed.

        4DownloadandorConfirmDuoMobileAppInstalledonPhoneorTablet(cropped).png

      3. In the Duo App on your device, tap the plus sign button.

      4. Using your device, scan the QR code on the screen in the MFA Portal and click Continue.

        The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment

        5SuccessfulQRCodeScanforPhoneorTablet(cropped).png

    1. Select Tablet then press Continue.

      device_type_tablet.PNG

    2. Select your device type (iOS or Android) and press Continue.

    3. Download the Duo Mobile Application for iOS or Android on your tablet, if not already downloaded:

    4. Configure the Duo App on your tablet and finish adding the device in MFA Portal:
      1. Open the Duo App on your tablet.

        Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.

      2. In the MFA Portal, click I have Duo Mobile installed.

        4DownloadandorConfirmDuoMobileAppInstalledonPhoneorTablet(cropped).png

    5. In the Duo App on your device, tap the plus sign button.

    6. Using your device, scan the QR code on the screen in the MFA Portal and click Continue.

      The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment

      5SuccessfulQRCodeScanforPhoneorTablet(cropped).png

      Note: You will need to obtain a token before you can register it. For information on how to obtain a token, see MFA-Duo - What is a token/fob?. It is very important that you not press the token button repeatedly prior to registering your token. This may cause the token to become out of sync and you will not be able to register it.
      1. Go to https://go.wisc.edu/token.

      2. Log in with your NetID and password.

      • Note: If you've already registered a device and are using MFA Duo, you'll be prompted to login with your NetID twice, then be prompted for MFA Duo.

    • Select the type of token that you have.

      register_fob_key.PNG

    • Enter the Token Serial Number in the appropriate field. The Token Serial Number may be entered with spaces/dashes or with numbers only; the format does not matter.

    • Making sure that the token's button is oriented to the left, press the button on the front of the token and enter the 6-digit passcode.

    • Click Register Duo Token/Fob.

    • The token will now be registered with your account.

    • Please note, if the token is the first MFA device you have registered, you'll will start being prompted for MFA.

      MFA only supports the U2F authentication method in the Google Chrome browser, so we highly recommend you use the U2F feature as a SECONDARY authentication method and have at least one other device enrolled.

      1. Login to the MFA Portal.

      2. Click Manage MFA Preferences and Devices.

        section of MFA portal with a button that reads Manage MFA Preferences and Devices.

      3. Authenticate using MFA.

      4. Click +Add another device to begin the registration process.

      5. Select Security Key from the device types. Click Continue.

        selection of device types: mobile phone, tablet, and security key - referenced in step 5.

      6. Click Continue to bring up a popup window for enrolling your security key. The key will need to be plugged into a USB port on your computer.

        the options Back and Continue which will appear after selecting Security Key from the device types.

        pop-up window that appears after clicking continue on the previous screen, prompting the user to insert the security key into a USB port and to tap the button.

      7. Tap the button on your device to complete enrollment.


      If run into any issues or have any questions, please contact the DoIT Help Desk.

  5. The device has been added. You should now see it in the Multi-Factor Authentication Portal.

Adding another device:

  1. Navigate to the Multi-Factor Authentication Portal at www.mfa.wisc.edu. Authenticate with your UW-Madison NetID and Password. authentication devices.

  2. Click Manage MFA Preferences and Devices.

    • Note: You will need to authenticate using an existing multi-factor authentication device.
  3. Click Add Another Device.

    my_devices.PNG

  4. Follow the instructions specific to the device type you would like to add.

    1. Select Mobile phone then press Continue.

      device_type_mobile.PNG

    2. Enter the phone number of the device. Next, verify this is the correct number of the device by checking the box. Now press Continue.

      3AddPhoneNumber(cropped).png

    3. Select the type of phone that the number is associated with (iPhone, Android, or Windows Phone) and press Continue.

    4. Download the Duo Mobile Application on the new device you are adding, if not already downloaded:

    5. Configure the Duo App on your mobile device and finish adding the device in MFA Portal:

      1. Open the Duo App on your phone.

        Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.

      2. In the MFA Portal, click I have Duo Mobile installed.

        4DownloadandorConfirmDuoMobileAppInstalledonPhoneorTablet(cropped).png

      3. In the Duo App on your device, tap the plus sign button.

      4. Using your device, scan the QR code on the screen in the MFA Portal and click Continue.

        The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment

        5SuccessfulQRCodeScanforPhoneorTablet(cropped).png

    1. Select Tablet then press Continue.

      device_type_tablet.PNG

    2. Select your device type (iOS or Android) and press Continue.

    3. Download the Duo Mobile Application for iOS or Android on your tablet, if not already downloaded:

    4. Configure the Duo App on your tablet and finish adding the device in MFA Portal:
      1. Open the Duo App on your tablet.

        Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.

      2. In the MFA Portal, click I have Duo Mobile installed.

        4DownloadandorConfirmDuoMobileAppInstalledonPhoneorTablet(cropped).png

    5. In the Duo App on your device, tap the plus sign button.

    6. Using your device, scan the QR code on the screen in the MFA Portal and click Continue.

      The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment

      5SuccessfulQRCodeScanforPhoneorTablet(cropped).png

      Note: You will need to obtain a token before you can register it. For information on how to obtain a token, see MFA-Duo - What is a token/fob?. It is very important that you not press the token button repeatedly prior to registering your token. This may cause the token to become out of sync and you will not be able to register it.
      1. Go to https://go.wisc.edu/token.

      2. Log in with your NetID and password.

      • Note: If you've already registered a device and are using MFA Duo, you'll be prompted to login with your NetID twice, then be prompted for MFA Duo.

    • Select the type of token that you have.

      register_fob_key.PNG

    • Enter the Token Serial Number in the appropriate field. The Token Serial Number may be entered with spaces/dashes or with numbers only; the format does not matter.

    • Making sure that the token's button is oriented to the left, press the button on the front of the token and enter the 6-digit passcode.

    • Click Register Duo Token/Fob.

    • The token will now be registered with your account.

    • Please note, if the token is the first MFA device you have registered, you'll will start being prompted for MFA.

      MFA only supports the U2F authentication method in the Google Chrome browser, so we highly recommend you use the U2F feature as a SECONDARY authentication method and have at least one other device enrolled.

      1. Login to the MFA Portal.

      2. Click Manage MFA Preferences and Devices.

        section of MFA portal with a button that reads Manage MFA Preferences and Devices.

      3. Authenticate using MFA.

      4. Click +Add another device to begin the registration process.

      5. Select Security Key from the device types. Click Continue.

        selection of device types: mobile phone, tablet, and security key - referenced in step 5.

      6. Click Continue to bring up a popup window for enrolling your security key. The key will need to be plugged into a USB port on your computer.

        the options Back and Continue which will appear after selecting Security Key from the device types.

        pop-up window that appears after clicking continue on the previous screen, prompting the user to insert the security key into a USB port and to tap the button.

      7. Tap the button on your device to complete enrollment.


      If run into any issues or have any questions, please contact the DoIT Help Desk.

  5. The device has been added. You should now see it in the Multi-Factor Authentication Portal.

Adding another device:

  1. Navigate to the Multi-Factor Authentication Portal at www.mfa.wisc.edu. Authenticate with your UW-Madison NetID and Password. authentication devices.

  2. Click Manage MFA Preferences and Devices.

    • Note: You will need to authenticate using an existing multi-factor authentication device.
  3. Click Add Another Device.

    my_devices.PNG

  4. Follow the instructions specific to the device type you would like to add.

    1. Select Mobile phone then press Continue.

      device_type_mobile.PNG

    2. Enter the phone number of the device. Next, verify this is the correct number of the device by checking the box. Now press Continue.

      3AddPhoneNumber(cropped).png

    3. Select the type of phone that the number is associated with (iPhone, Android, or Windows Phone) and press Continue.

    4. Download the Duo Mobile Application on the new device you are adding, if not already downloaded:

    5. Configure the Duo App on your mobile device and finish adding the device in MFA Portal:

      1. Open the Duo App on your phone.

        Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.

      2. In the MFA Portal, click I have Duo Mobile installed.

        4DownloadandorConfirmDuoMobileAppInstalledonPhoneorTablet(cropped).png

      3. In the Duo App on your device, tap the plus sign button.

      4. Using your device, scan the QR code on the screen in the MFA Portal and click Continue.

        The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment

        5SuccessfulQRCodeScanforPhoneorTablet(cropped).png

    1. Select Tablet then press Continue.

      device_type_tablet.PNG

    2. Select your device type (iOS or Android) and press Continue.

    3. Download the Duo Mobile Application for iOS or Android on your tablet, if not already downloaded:

    4. Configure the Duo App on your tablet and finish adding the device in MFA Portal:
      1. Open the Duo App on your tablet.

        Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.

      2. In the MFA Portal, click I have Duo Mobile installed.

        4DownloadandorConfirmDuoMobileAppInstalledonPhoneorTablet(cropped).png

    5. In the Duo App on your device, tap the plus sign button.

    6. Using your device, scan the QR code on the screen in the MFA Portal and click Continue.

      The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment

      5SuccessfulQRCodeScanforPhoneorTablet(cropped).png

      Note: You will need to obtain a token before you can register it. For information on how to obtain a token, see MFA-Duo - What is a token/fob?. It is very important that you not press the token button repeatedly prior to registering your token. This may cause the token to become out of sync and you will not be able to register it.
      1. Go to https://go.wisc.edu/token.

      2. Log in with your NetID and password.

      • Note: If you've already registered a device and are using MFA Duo, you'll be prompted to login with your NetID twice, then be prompted for MFA Duo.

    • Select the type of token that you have.

      register_fob_key.PNG

    • Enter the Token Serial Number in the appropriate field. The Token Serial Number may be entered with spaces/dashes or with numbers only; the format does not matter.

    • Making sure that the token's button is oriented to the left, press the button on the front of the token and enter the 6-digit passcode.

    • Click Register Duo Token/Fob.

    • The token will now be registered with your account.

    • Please note, if the token is the first MFA device you have registered, you'll will start being prompted for MFA.

      MFA only supports the U2F authentication method in the Google Chrome browser, so we highly recommend you use the U2F feature as a SECONDARY authentication method and have at least one other device enrolled.

      1. Login to the MFA Portal.

      2. Click Manage MFA Preferences and Devices.

        section of MFA portal with a button that reads Manage MFA Preferences and Devices.

      3. Authenticate using MFA.

      4. Click +Add another device to begin the registration process.

      5. Select Security Key from the device types. Click Continue.

        selection of device types: mobile phone, tablet, and security key - referenced in step 5.

      6. Click Continue to bring up a popup window for enrolling your security key. The key will need to be plugged into a USB port on your computer.

        the options Back and Continue which will appear after selecting Security Key from the device types.

        pop-up window that appears after clicking continue on the previous screen, prompting the user to insert the security key into a USB port and to tap the button.

      7. Tap the button on your device to complete enrollment.


      If run into any issues or have any questions, please contact the DoIT Help Desk.

  5. The device has been added. You should now see it in the Multi-Factor Authentication Portal.

Adding another device:

  1. Navigate to the Multi-Factor Authentication Portal at www.mfa.wisc.edu. Authenticate with your UW-Madison NetID and Password. authentication devices.

  2. Click Manage MFA Preferences and Devices.

    • Note: You will need to authenticate using an existing multi-factor authentication device.
  3. Click Add Another Device.

    my_devices.PNG

  4. Follow the instructions specific to the device type you would like to add.

    1. Select Mobile phone then press Continue.

      device_type_mobile.PNG

    2. Enter the phone number of the device. Next, verify this is the correct number of the device by checking the box. Now press Continue.

      3AddPhoneNumber(cropped).png

    3. Select the type of phone that the number is associated with (iPhone, Android, or Windows Phone) and press Continue.

    4. Download the Duo Mobile Application on the new device you are adding, if not already downloaded:

    5. Configure the Duo App on your mobile device and finish adding the device in MFA Portal:

      1. Open the Duo App on your phone.

        Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.

      2. In the MFA Portal, click I have Duo Mobile installed.

        4DownloadandorConfirmDuoMobileAppInstalledonPhoneorTablet(cropped).png

      3. In the Duo App on your device, tap the plus sign button.

      4. Using your device, scan the QR code on the screen in the MFA Portal and click Continue.

        The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment

        5SuccessfulQRCodeScanforPhoneorTablet(cropped).png

    1. Select Tablet then press Continue.

      device_type_tablet.PNG

    2. Select your device type (iOS or Android) and press Continue.

    3. Download the Duo Mobile Application for iOS or Android on your tablet, if not already downloaded:

    4. Configure the Duo App on your tablet and finish adding the device in MFA Portal:
      1. Open the Duo App on your tablet.

        Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.

      2. In the MFA Portal, click I have Duo Mobile installed.

        4DownloadandorConfirmDuoMobileAppInstalledonPhoneorTablet(cropped).png

    5. In the Duo App on your device, tap the plus sign button.

    6. Using your device, scan the QR code on the screen in the MFA Portal and click Continue.

      The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment

      5SuccessfulQRCodeScanforPhoneorTablet(cropped).png

      Note: You will need to obtain a token before you can register it. For information on how to obtain a token, see MFA-Duo - What is a token/fob?. It is very important that you not press the token button repeatedly prior to registering your token. This may cause the token to become out of sync and you will not be able to register it.
      1. Go to https://go.wisc.edu/token.

      2. Log in with your NetID and password.

      • Note: If you've already registered a device and are using MFA Duo, you'll be prompted to login with your NetID twice, then be prompted for MFA Duo.

    • Select the type of token that you have.

      register_fob_key.PNG

    • Enter the Token Serial Number in the appropriate field. The Token Serial Number may be entered with spaces/dashes or with numbers only; the format does not matter.

    • Making sure that the token's button is oriented to the left, press the button on the front of the token and enter the 6-digit passcode.

    • Click Register Duo Token/Fob.

    • The token will now be registered with your account.

    • Please note, if the token is the first MFA device you have registered, you'll will start being prompted for MFA.

      MFA only supports the U2F authentication method in the Google Chrome browser, so we highly recommend you use the U2F feature as a SECONDARY authentication method and have at least one other device enrolled.

      1. Login to the MFA Portal.

      2. Click Manage MFA Preferences and Devices.

        section of MFA portal with a button that reads Manage MFA Preferences and Devices.

      3. Authenticate using MFA.

      4. Click +Add another device to begin the registration process.

      5. Select Security Key from the device types. Click Continue.

        selection of device types: mobile phone, tablet, and security key - referenced in step 5.

      6. Click Continue to bring up a popup window for enrolling your security key. The key will need to be plugged into a USB port on your computer.

        the options Back and Continue which will appear after selecting Security Key from the device types.

        pop-up window that appears after clicking continue on the previous screen, prompting the user to insert the security key into a USB port and to tap the button.

      7. Tap the button on your device to complete enrollment.


      If run into any issues or have any questions, please contact the DoIT Help Desk.

  5. The device has been added. You should now see it in the Multi-Factor Authentication Portal.

Adding another device:

  1. Navigate to the Multi-Factor Authentication Portal at www.mfa.wisc.edu. Authenticate with your UW-Madison NetID and Password. authentication devices.

  2. Click Manage MFA Preferences and Devices.

    • Note: You will need to authenticate using an existing multi-factor authentication device.
  3. Click Add Another Device.

    my_devices.PNG

  4. Follow the instructions specific to the device type you would like to add.

    1. Select Mobile phone then press Continue.

      device_type_mobile.PNG

    2. Enter the phone number of the device. Next, verify this is the correct number of the device by checking the box. Now press Continue.

      3AddPhoneNumber(cropped).png

    3. Select the type of phone that the number is associated with (iPhone, Android, or Windows Phone) and press Continue.

    4. Download the Duo Mobile Application on the new device you are adding, if not already downloaded:

    5. Configure the Duo App on your mobile device and finish adding the device in MFA Portal:

      1. Open the Duo App on your phone.

        Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.

      2. In the MFA Portal, click I have Duo Mobile installed.

        4DownloadandorConfirmDuoMobileAppInstalledonPhoneorTablet(cropped).png

      3. In the Duo App on your device, tap the plus sign button.

      4. Using your device, scan the QR code on the screen in the MFA Portal and click Continue.

        The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment

        5SuccessfulQRCodeScanforPhoneorTablet(cropped).png

    1. Select Tablet then press Continue.

      device_type_tablet.PNG

    2. Select your device type (iOS or Android) and press Continue.

    3. Download the Duo Mobile Application for iOS or Android on your tablet, if not already downloaded:

    4. Configure the Duo App on your tablet and finish adding the device in MFA Portal:
      1. Open the Duo App on your tablet.

        Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.

      2. In the MFA Portal, click I have Duo Mobile installed.

        4DownloadandorConfirmDuoMobileAppInstalledonPhoneorTablet(cropped).png

    5. In the Duo App on your device, tap the plus sign button.

    6. Using your device, scan the QR code on the screen in the MFA Portal and click Continue.

      The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment

      5SuccessfulQRCodeScanforPhoneorTablet(cropped).png

      Note: You will need to obtain a token before you can register it. For information on how to obtain a token, see MFA-Duo - What is a token/fob?. It is very important that you not press the token button repeatedly prior to registering your token. This may cause the token to become out of sync and you will not be able to register it.
      1. Go to https://go.wisc.edu/token.

      2. Log in with your NetID and password.

      • Note: If you've already registered a device and are using MFA Duo, you'll be prompted to login with your NetID twice, then be prompted for MFA Duo.

    • Select the type of token that you have.

      register_fob_key.PNG

    • Enter the Token Serial Number in the appropriate field. The Token Serial Number may be entered with spaces/dashes or with numbers only; the format does not matter.

    • Making sure that the token's button is oriented to the left, press the button on the front of the token and enter the 6-digit passcode.

    • Click Register Duo Token/Fob.

    • The token will now be registered with your account.

    • Please note, if the token is the first MFA device you have registered, you'll will start being prompted for MFA.

      MFA only supports the U2F authentication method in the Google Chrome browser, so we highly recommend you use the U2F feature as a SECONDARY authentication method and have at least one other device enrolled.

      1. Login to the MFA Portal.

      2. Click Manage MFA Preferences and Devices.

        section of MFA portal with a button that reads Manage MFA Preferences and Devices.

      3. Authenticate using MFA.

      4. Click +Add another device to begin the registration process.

      5. Select Security Key from the device types. Click Continue.

        selection of device types: mobile phone, tablet, and security key - referenced in step 5.

      6. Click Continue to bring up a popup window for enrolling your security key. The key will need to be plugged into a USB port on your computer.

        the options Back and Continue which will appear after selecting Security Key from the device types.

        pop-up window that appears after clicking continue on the previous screen, prompting the user to insert the security key into a USB port and to tap the button.

      7. Tap the button on your device to complete enrollment.


      If run into any issues or have any questions, please contact the DoIT Help Desk.

  5. The device has been added. You should now see it in the Multi-Factor Authentication Portal.

Adding another device:

  1. Navigate to the Multi-Factor Authentication Portal at www.mfa.wisc.edu. Authenticate with your UW-Madison NetID and Password. authentication devices.

  2. Click Manage MFA Preferences and Devices.

    • Note: You will need to authenticate using an existing multi-factor authentication device.
  3. Click Add Another Device.

    my_devices.PNG

  4. Follow the instructions specific to the device type you would like to add.

    1. Select Mobile phone then press Continue.

      device_type_mobile.PNG

    2. Enter the phone number of the device. Next, verify this is the correct number of the device by checking the box. Now press Continue.

      3AddPhoneNumber(cropped).png

    3. Select the type of phone that the number is associated with (iPhone, Android, or Windows Phone) and press Continue.

    4. Download the Duo Mobile Application on the new device you are adding, if not already downloaded:

    5. Configure the Duo App on your mobile device and finish adding the device in MFA Portal:

      1. Open the Duo App on your phone.

        Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.

      2. In the MFA Portal, click I have Duo Mobile installed.

        4DownloadandorConfirmDuoMobileAppInstalledonPhoneorTablet(cropped).png

      3. In the Duo App on your device, tap the plus sign button.

      4. Using your device, scan the QR code on the screen in the MFA Portal and click Continue.

        The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment

        5SuccessfulQRCodeScanforPhoneorTablet(cropped).png

    1. Select Tablet then press Continue.

      device_type_tablet.PNG

    2. Select your device type (iOS or Android) and press Continue.

    3. Download the Duo Mobile Application for iOS or Android on your tablet, if not already downloaded:

    4. Configure the Duo App on your tablet and finish adding the device in MFA Portal:
      1. Open the Duo App on your tablet.

        Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.

      2. In the MFA Portal, click I have Duo Mobile installed.

        4DownloadandorConfirmDuoMobileAppInstalledonPhoneorTablet(cropped).png

    5. In the Duo App on your device, tap the plus sign button.

    6. Using your device, scan the QR code on the screen in the MFA Portal and click Continue.

      The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment

      5SuccessfulQRCodeScanforPhoneorTablet(cropped).png

      Note: You will need to obtain a token before you can register it. For information on how to obtain a token, see MFA-Duo - What is a token/fob?. It is very important that you not press the token button repeatedly prior to registering your token. This may cause the token to become out of sync and you will not be able to register it.
      1. Go to https://go.wisc.edu/token.

      2. Log in with your NetID and password.

      • Note: If you've already registered a device and are using MFA Duo, you'll be prompted to login with your NetID twice, then be prompted for MFA Duo.

    • Select the type of token that you have.

      register_fob_key.PNG

    • Enter the Token Serial Number in the appropriate field. The Token Serial Number may be entered with spaces/dashes or with numbers only; the format does not matter.

    • Making sure that the token's button is oriented to the left, press the button on the front of the token and enter the 6-digit passcode.

    • Click Register Duo Token/Fob.

    • The token will now be registered with your account.

    • Please note, if the token is the first MFA device you have registered, you'll will start being prompted for MFA.

      MFA only supports the U2F authentication method in the Google Chrome browser, so we highly recommend you use the U2F feature as a SECONDARY authentication method and have at least one other device enrolled.

      1. Login to the MFA Portal.

      2. Click Manage MFA Preferences and Devices.

        section of MFA portal with a button that reads Manage MFA Preferences and Devices.

      3. Authenticate using MFA.

      4. Click +Add another device to begin the registration process.

      5. Select Security Key from the device types. Click Continue.

        selection of device types: mobile phone, tablet, and security key - referenced in step 5.

      6. Click Continue to bring up a popup window for enrolling your security key. The key will need to be plugged into a USB port on your computer.

        the options Back and Continue which will appear after selecting Security Key from the device types.

        pop-up window that appears after clicking continue on the previous screen, prompting the user to insert the security key into a USB port and to tap the button.

      7. Tap the button on your device to complete enrollment.


      If run into any issues or have any questions, please contact the DoIT Help Desk.

  5. The device has been added. You should now see it in the Multi-Factor Authentication Portal.

Adding another device:

  1. Navigate to the Multi-Factor Authentication Portal at www.mfa.wisc.edu. Authenticate with your UW-Madison NetID and Password. authentication devices.

  2. Click Manage MFA Preferences and Devices.

    • Note: You will need to authenticate using an existing multi-factor authentication device.
  3. Click Add Another Device.

    my_devices.PNG

  4. Follow the instructions specific to the device type you would like to add.

    1. Select Mobile phone then press Continue.

      device_type_mobile.PNG

    2. Enter the phone number of the device. Next, verify this is the correct number of the device by checking the box. Now press Continue.

      3AddPhoneNumber(cropped).png

    3. Select the type of phone that the number is associated with (iPhone, Android, or Windows Phone) and press Continue.

    4. Download the Duo Mobile Application on the new device you are adding, if not already downloaded:

    5. Configure the Duo App on your mobile device and finish adding the device in MFA Portal:

      1. Open the Duo App on your phone.

        Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.

      2. In the MFA Portal, click I have Duo Mobile installed.

        4DownloadandorConfirmDuoMobileAppInstalledonPhoneorTablet(cropped).png

      3. In the Duo App on your device, tap the plus sign button.

      4. Using your device, scan the QR code on the screen in the MFA Portal and click Continue.

        The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment

        5SuccessfulQRCodeScanforPhoneorTablet(cropped).png

    1. Select Tablet then press Continue.

      device_type_tablet.PNG

    2. Select your device type (iOS or Android) and press Continue.

    3. Download the Duo Mobile Application for iOS or Android on your tablet, if not already downloaded:

    4. Configure the Duo App on your tablet and finish adding the device in MFA Portal:
      1. Open the Duo App on your tablet.

        Note: After opening the Duo App, you may be asked to accept notification and camera privileges. Click Allow if prompted.

      2. In the MFA Portal, click I have Duo Mobile installed.

        4DownloadandorConfirmDuoMobileAppInstalledonPhoneorTablet(cropped).png

    5. In the Duo App on your device, tap the plus sign button.

    6. Using your device, scan the QR code on the screen in the MFA Portal and click Continue.

      The following video from Duo demonstrates how to scan the QR code: Duo Self Enrollment

      5SuccessfulQRCodeScanforPhoneorTablet(cropped).png

      Note: You will need to obtain a token before you can register it. For information on how to obtain a token, see MFA-Duo - What is a token/fob?. It is very important that you not press the token button repeatedly prior to registering your token. This may cause the token to become out of sync and you will not be able to register it.
      1. Go to https://go.wisc.edu/token.

      2. Log in with your NetID and password.

      • Note: If you've already registered a device and are using MFA Duo, you'll be prompted to login with your NetID twice, then be prompted for MFA Duo.

    • Select the type of token that you have.

      register_fob_key.PNG

    • Enter the Token Serial Number in the appropriate field. The Token Serial Number may be entered with spaces/dashes or with numbers only; the format does not matter.

    • Making sure that the token's button is oriented to the left, press the button on the front of the token and enter the 6-digit passcode.

    • Click Register Duo Token/Fob.

    • The token will now be registered with your account.

    • Please note, if the token is the first MFA device you have registered, you'll will start being prompted for MFA.

      MFA only supports the U2F authentication method in the Google Chrome browser, so we highly recommend you use the U2F feature as a SECONDARY authentication method and have at least one other device enrolled.

      1. Login to the MFA Portal.

      2. Click Manage MFA Preferences and Devices.

        section of MFA portal with a button that reads Manage MFA Preferences and Devices.

      3. Authenticate using MFA.

      4. Click +Add another device to begin the registration process.

      5. Select Security Key from the device types. Click Continue.

        selection of device types: mobile phone, tablet, and security key - referenced in step 5.

      6. Click Continue to bring up a popup window for enrolling your security key. The key will need to be plugged into a USB port on your computer.

        the options Back and Continue which will appear after selecting Security Key from the device types.

        pop-up window that appears after clicking continue on the previous screen, prompting the user to insert the security key into a USB port and to tap the button.

      7. Tap the button on your device to complete enrollment.


      If run into any issues or have any questions, please contact the DoIT Help Desk.

  5. The device has been added. You should now see it in the Multi-Factor Authentication Portal.

2. Use the "Remember Me for 12 Hours" option

Having to use MFA Duo for every NetID login session can become tedious. Use the "Remember Me for 12 Hours" option to minimize the number of times you'll need to authenticate with MFA Duo:

Please see the Troubleshooting section below if you find that "remember me" is not working for you.

In order to login with Duo Multi-factor Authentication, you must have first set up a device and linked it with your NetID. If you have not yet completed this, follow the instructions here: MFA-Duo - How to Enroll for MFA Duo for your NetID Login Account

Using "Remember Me for 12 hours"

  1. Navigate to a page that requires Duo Multi-factor Authentication after NetID login (e.g. MyUW).

  2. Authenticate with your NetID and Password.

  3. Before choosing an authentication method, check the box next to "Remember me for 12 hours".

    remember_me.PNG

  4. Proceed with your MFA Duo login as usual by clicking Send Me a Push or Enter a Passcode.

Note: If the "Remember me for 12 hours" option is grayed out, your MFA-Duo authentication method is set up to automatically send a push;

You can still use "Remember me for 12 hours" without changing device settings by:

  1. Click cancel on your initial push request.
  2. KB-001-Cancel.png

  3. Click "Remember me for 12 hours".
  4. Proceed with your MFA Duo login as usual by clicking Send Me a Push or Enter a Passcode.

UW-Madison strongly recommends you do NOT select 'Automatically send this device a Duo Push' so that you can easily take advantage of "Remember me for 12 hours" Follow the steps below to change your MFA-Duo settings:

Changing your settings to no longer default to Push

  1. Navigate to the Multi-Factor Authentication Portal.

  2. Authenticate with your NetID and password, and with MFA-Duo.

  3. Change the "When I log in" drop-down option to "Ask me to choose an authentication method."

  4. \


  Troubleshooting "Remember Me"

Users may find that they are prompted for MFA-Duo within 12 hours even after they have selected the "remember me for 12 hours" box. The "remember me" feature relies on a browser cookie to function.

"remember me" may not work in the following situations:
  • If you close your browser or switch to a new browser.
  • If you switch to a different computer.
  • If you are using private/incognito browsing mode.
  • If your browser does not allow cookies to be saved.
  • If you clear your browser cookies
Here are some basic troubleshooting tips to ensure that "remember me" works.
  1. Make sure that your internet browser allows cookies from the duosecurity.com domain to be stored in your browser.
  • In Safari, go to Safari > Preferences > Privacy. Under Cookies and website data click Allow from websites I visit. Restart your browser and try "remember me" again.
  • In Internet Explorer, go to Tools > Options > Privacy. Adjust the slider for the Internet zone to allow third-party cookies to be stored. Restart your browser and try "remember me" again.
  • In Firefox, go to Firefox > Preferences > Privacy & Security. Ensure Third-Party Cookies are not blocked. Under Cookies and Site Data click Accept cookies and site data.
    Restart your browser and try "remember me" again.
  • In Chrome, go to Preferences > Settings > Show advanced settings > Content settings. Ensure Block third-party cookies is not selected. Restart your browser and try "remember me" again.
  • If you have browser extensions or plug-ins installed, disable or remove them to see if "remember me" works. Many browser extensions and plug-ins prevent cookies.
  • If the steps above do not resolve the issue, please contact the DoIT Help Desk.



    1. Keywords:iphone ios android samsung lg galaxy application edit remove 2 two factor auth authentication login request approve   Doc ID:80774
      Owner:Abrianna B.Group:Multi-Factor Authentication (MFA)
      Created:2018-03-10 15:37 CDTUpdated:2018-12-26 13:54 CDT
      Sites:DoIT Help Desk, Multi-Factor Authentication (MFA)
      Feedback:  4   1