Skip to content Accessibility statement
IT Services
HomeIT ServicesAbout usNews2026Upcoming security update: DUO two factor authentication

Upcoming security update: DUO two factor authentication

News

Posted on Monday 1 June 2026

To further strengthen account security, we are updating our Duo Two Factor Authentication (2FA) process over the coming months.

We will be introducing Duo Verified Push and discontinuing SMS (text message) as an authentication method.

You will be affected if:

  • You currently use Duo Mobile push notifications. You will transition to the new Verified Push method detailed below.
  • You use SMS and have a device capable of supporting Duo Mobile. You will no longer be able to use SMS. You must download the Duo Mobile app to use Verified Push.
  • You use SMS but your device doesn't support the app. IT Services will contact you directly to provide alternative authentication options.

Users who use a hardware token as their two factor authentication will see no change to their authentication process and are not affected.

What is changing and why?

Currently, app users receive a notification on their phone and tap “Approve”.

With the new Verified Push method, a 3-digit code will appear on your device login screen. You will be prompted to enter this code into the Duo Mobile app on your phone. Once entered, your login will be verified and complete.

In addition, SMS text messages will no longer be available as a 2FA method. If you currently use SMS  you must switch to the Duo Mobile app (or a hardware token if the app is not available on your device, this is already common practice for some Microsoft and Google users).

By no longer using SMS and changing to the new verified push method, we are moving towards more secure approval methods to match industry standards. Such changes are necessary not only to bring the University in line with recommended security standards, but also to protect the University from attacks such as the recent phishing campaign which resulted in a successful account compromise.

Next steps

Please ensure that your Duo Mobile app is up to date via the App Store or Google Play Store.

Find more information about how we use Duo at the University.

If you have any questions, please contact the IT Help Desk (itsupport@york.ac.uk)

We will share more details and specific timelines as the rollout date approaches.