Accessibility statement

Duo two-factor authentication

Related pages

Two-factor authentication (2FA) provides an additional layer of security when you log on to IT systems from any device (eg laptop, desktop, phone, tablet). It's commonly used for online services like banking.

  • First factor: entering your password - proof that you know the right credentials
  • Second factor: normally using a mobile app (but see further information below) - proof that you possess something

This ensures that even if someone has your password, they still won't have enough information to access your account.

Overview

Eligibility

All staff and students can register for Duo two-factor authentication.

Changed your phone?

Follow this guide to restore access to your account:

How to register

You can register your mobile phone or tablet with the Duo SelfService Console yourself. For detailed instructions see:

As part of the registration process you will be prompted to install the free Duo Mobile app. This is what we recommend, as it's the simplest way to use Duo:

If you're a member of staff who doesn't want to use your mobile device for Duo 2FA, or if you have accessibility requirements which make using the mobile app difficult, please contact IT Services to discuss other options.

Logging in to University services with Duo

For step-by-step instructions on how to log in to University services that are protected by Duo, see:

If you have a compatible mobile phone or tablet, we recommend using the Duo Mobile app, as this provides the best balance of security and ease of use.

Using the Duo Mobile app

  1. Log in to the system that you wish to use with your username and password
  2. Tap to accept the confirmation that is sent to your mobile phone or tablet

Alternatively, the Duo Mobile app can also be used to generate numerical passcodes that you can type into the system login screen during authentication.

See the Help & troubleshooting tab for further guidance on using Duo.

Other methods

Where the Duo Mobile app isn't appropriate, there are other options available:

  • Passcodes sent to you via text message
  • YubiKey security key (available to request if the Duo Mobile app or text message passcodes are not an option)

See the Other authentication options tab for more information on using these methods or contact IT Services to discuss them further.

Other authentication options

Text message passcodes

You can use a mobile device without having to install an app

Once registered you will be sent a passcode via SMS text message that you can type into the system login screen during authentication.

The University will never charge for using the text message passcodes option but your mobile provider's standard charges will apply - for example, if you are roaming and receiving SMS messages attracts a charge.

You will need to use text message passcodes if you have an Android phone that is unable to access the Google Play Store to download the Duo Mobile app. 

YubiKey security key

These are available to request if the Duo Mobile app or text message passcode isn't an option for you.

If you are unable to use your work or personal mobile device to authenticate to protected systems, you can request a YubiKey security key.

This is a small USB device that you connect to your computer. You tap the gold contact during the login process to authenticate. These security keys also work with Google two-factor authentication.

Our commitments

Service status Live and supported service.
Hours of service 24/7
Service support For help and support with this service, contact IT Services.
Hours of support Help from the Library & IT Help Desk is available 9am to 5pm, Monday to Friday.
Target availability

General IT Services targets:

  • Information Services Service Standards
Our performance

Our service standards have been produced in consultation with our customers, and monitor the quality, timeliness and access to facilities and services:

  • Information Services Service Standards

Complaints procedure

If you wish to give us general feedback on this service, please see our Feedback page for ways to get in touch.

If you wish to make a complaint, please see our complaints procedure.

Your responsibilities

We expect you:

  • to register for the Duo 2FA service
  • carry or have access to your registered second factor device (eg your mobile or key token) at all times when you may need to log onto a protected system
  • maintain the security of the service by not allowing anyone else to authenticate using their second factor device
  • contact IT Services promptly if you lose your second factor device.

Privacy

Please note:

  • to use the Duo Mobile app you do not need to provide a phone number
  • to use the text message passcode option you do not have to install the Duo Mobile app onto your phone
  • when using the text message passcode option no information is transmitted from your phone to Duo
  • when using the Duo Mobile app option no information other than your phone number (if provided), phone model, phone operating system version and Duo Mobile software version is transmitted by the app.

See the Duo Mobile Privacy Information for further details.