Duo Multi-Factor Authentication
Duo is a Multi-Factor Authentication (MFA) tool utilized by CCC employees for certain access. Using MFA provides another layer of security to protect data by ensuring a user uses something they know (username/password) with something they have (mobile phone, Security Key) to log in.
Device Requirements:
Duo requires either a SmartPhone for the Duo App, SMS-capable Cellphone for Text messages, or a USB hardware key for authentication.
- SmartPhone - Uses the Duo Mobile App for quick approve/deny notifications.
- Requires a recent version of Android, iOS, or iPadOS to run.
- Users can connect their mobile devices to the CCC-Access/CCC-Student Wi-Fi networks on campus if their data is limited.
- SMS-Capable Cellphone – Sends an SMS text message with a short code to be entered when signing in.
- USB Security/Hardware Key – Physical USB device.
- Security keys can be used for accessing web applications protected with Duo. Security keys cannot be used for Windows Authentication for Duo.
- Hardware Keys can be used for Windows Authentication. If a user does not have a mobile device or does not want to use their mobile device, their supervisor will need to speak with ITS to purchase a hardware key.
Enrolling
Enrolling in Duo through Duo Central
Employees can self-enroll in Duo without being invited by navigating to Duo Central and logging in.
1. Navigate to Duo Central.
2. Login to myCCC using your Comet ID and Password.
3. If you have not enrolled, you will be greeted with the following Welcome screen.
4. Select the factor to be used when logging in.
a. Duo Mobile App – Push notifications to approve/deny login. Recommended.
c. Security Key – Physical USB key. Keys will not be provided by ITS. Use of personal Security Keys is not recommended.
d. Phone Number – For devices that cannot install the Duo Mobile App.
Duo Mobile App
1. Enter the number of the mobile phone where the Duo App will be installed.
This phone number will also be automatically enrolled in SMS Text Authentication as a backup.
If you are using a Tablet or a device without an active phone number attached, select "I have a Tablet" (Step 3).
2. Verify the number is correct.
3. If you haven't already, follow the steps to download the Duo Mobile App. Only available for Android, iOS, and iPadOS.
4. In the app, select "Add New Account" then "Use QR Code." Scan the QR Code displayed.
If you are unable to scan the QR code, select "Get an activation link instead" to be emailed a link instead. (Step 5)
5. If you are unable to scan the QR Code select the Activation link option.
Follow the steps in your email to install the app and verify.
6. Once completed, the QR code will be greyed out with a checkmark to indicate the app has been successfully attached.
7. After the app has been added, you will see a confirmation page.
Note: If you follow the instructions for setting up a Tablet, your phone number was not added as an additional method.
8. If you want to add additional methods of authentication, you can add them before exiting. If you only added the Duo App, it's recommended to add your phone number as a text backup. If the option does not exist to add a phone number, it's already been added in the above steps.
9. Congratulations! Your Duo account is ready to go.
SMS / Text Message
1. Enter the number of the cellphone where texts will be sent.
2. Verify the number is correct.
3. Confirm ownership of the number. Select Send me a Passcode.
4. You should receive a text message within 1–3 minutes. Enter the code received.
5. After entering the code and selecting Verify, you will see a confirmation screen.
6. If you want to add additional methods of authentication, you can add them before exiting.
ITS recommends using the Duo Mobile App if possible, as the app is faster than texting and provides Offline Access capabilities for Windows Logins.
If you add another device with the options provided, you will be guided through the steps. For more information, view the other sections on this page.
7. Congratulations! Your Duo account is ready to go.
Security Key / Hardware Key
Note: Security Keys enrolled through Duo Central cannot be used for Windows Logins. Only Hardware Keys approved by ITS can be used for Windows Logins.
Any security key added through the self-enrollment can only be used for Web-based applications at this time. (Webmail, Office 365, Duo Central, etc)
1. Select Security key and insert your key into an open USB port on your computer.
If your Security Key has USB-C or Lightning ports, you may be able to enroll using your mobile device.
2. A browser-specific screen should appear. When prompted, press/touch the capacitive area of your key. On most keys, this is a small lit-up area.
3. If the key is recognized, it will be added immediately and you will receive a confirmation prompt.
If the key is not recognized, try unplugging and plugging back in, or try additional USB ports.
4. If you want to add additional methods of authentication, you can add them before exiting.
ITS highly recommends adding your phone number as a backup. If a security key fails, you must come to the ITS Help Desk to set up a new device, having SMS as a backup ensure access on weekends and nights when the college is closed.
If you add another device with the options provided, you will be guided through the steps. For more information, view the other sections on this page.
5. Congratulations! Your Duo account is ready to go.
Enrolling in Duo through Employee Webmail with a Mobile Device
1. Navigate to the Employee Webmail page found in the "Faculty & Staff" dropdown menu of the CCC website.
2. Login using your Comet ID and password.
3. If you are a new employee, or your password has recently expired, you will be prompted to reset your password. For password guidelines and restrictions, visit our Password Information page.
a. After successfully resetting your password, choose "OK" to sign in again with your new password.
4. After successfully signing in, you will be prompted to enroll in Duo. The enrollment page will provide details of Duo with additional links for information and assistance. After reading the introductory text, choose “Start Setup.”
5. Choose Mobile Phone for App/SMS.
a. Mobile Phone – Supports App and SMS. Recommended.
b. Tablet – Must be accessible by the user in travel and remote. Phones are recommended over tablets as they usually support SMS as a backup.
c. Security Key – Physical USB key. Keys will not be provided by ITS. Use of personal Security Keys is not recommended.
d. Touch ID – Not available for Windows/Android. Touch ID is not recommended at this time.
6. Enter your mobile device number in the input box. Your number will be used for SMS and/or setting up the mobile app. After entering your phone number, confirm the input is correct with the checkbox.
7. Choose your mobile device operating system.
a. Phone, Android, or Windows Phone will prompt to install the Duo Mobile App. (Step 8)
b. “Other” is intended for SMS text only and will not prompt to install the Duo Mobile App. (Step 9)
8. iPhone/Android Phone Find Duo Mobile on the App Store and install.
a. The enrollment email provides direct links that can be opened on your phone to the Google Play Store and Apple App Store.
b. After installing the Duo Mobile App and selecting “I have Duo Mobile installed” you’ll be prompted to scan the QR code using the app. Once the QR code has been scanned successfully, it will be greyed out with a checkmark in front of it.
9. Other/SMS: You will need to verify your number via text. Request Duo to “Text Me” and enter the code to verify.
10. Your mobile device number has been added to your Duo account. After choosing a device, you can change the method for authentication prompts.
a. If you have set up the App, you can use the drop-down to choose to have the app automatically push notifications instead of having to choose each time.
11. Webmail's enrollment provides additional options to Reactive Duo Mobile, Change the Device Name of the attached method, and adding additional devices. Adding Addition Devices goes through the step above to enroll more.
12. Once finished enrolling devices, select "Continue to Login" to finish enrollment.
Enrolling in Duo through Email with a Mobile Device
1. You will receive an email from Duo with an enrollment link. The link can be opened in a browser (Chrome, Firefox, Safari, etc.) on your computer or your mobile device. An example of the email is shown below.
2. The enrollment page will provide details of Duo with additional links for information and assistance. After reading the introductory text, choose “Start Setup.”
3. Choose Mobile Phone for App/SMS.
a. Mobile Phone – Supports App and SMS. Recommended.
b. Tablet – Must be accessible by the user in travel and remote. Phones are recommended over tablets as they usually support SMS as a backup.
c. Security Key – Physical USB key. Keys will not be provided by ITS. Use of personal Security Keys is not recommended.
d. Touch ID – Not available for Windows/Android. Touch ID is not recommended at this time.
4. Enter your mobile device number in the input box. Your number will be used for SMS and/or setting up the mobile app. After entering your phone number, confirm the input is correct with the checkbox.
5. Choose your mobile device operating system.
a. Phone, Android, or Windows Phone will prompt to install the Duo Mobile App. (Step 6)
b. “Other” is intended for SMS text only and will not prompt to install the Duo Mobile App. (Step 7)
6. iPhone/Android Phone Find Duo Mobile on the App Store and install.
a. The enrollment email provides direct links that can be opened on your phone to the Google Play Store and Apple App Store.
b. After installing the Duo Mobile App and selecting “I have Duo Mobile installed” you’ll be prompted to scan the QR code using the app. Once the QR code has been scanned successfully, it will be greyed out with a checkmark in front of it.
7. Other/SMS: You will need to verify your number via text. Request Duo to “Text Me” and enter the code to verify.
8. Your mobile device number has been added to your Duo account. After choosing a device, you can change the method for authentication prompts.
a. If you have set up the App, you can use the drop-down to choose to have the app automatically push notifications instead of having to choose each time.
9. After finishing enrollment, you’ll be congratulated.
Enrolling in Duo through Email with a Security Key
Before continuing, please acknowledge the following:
- When enrolling a security key, ITS recommends also enrolling a mobile device with at least SMS Text Messages. Certain devices may not support a USB security key, and if a security key fails outside of business hours, a user may not be able to sign in for an extended period.
- Enrolling a security key through the self-service will not work for Windows Authentication, only for web-based applications. (Webmail, Office 365, etc.). Please work with your supervisor and the ITS Help Desk to set up a hardware key for Windows Authentication as needed.
- Enrolling a key may not work correctly if using a mobile device. ITS recommends following the steps on a computer to enroll a security key.
1. You will receive an email from Duo with an enrollment link. The link can be opened in a browser (Chrome, Firefox, Safari, etc.) on your computer or your mobile device. An example of the email is shown below.
2. The enrollment page will provide details of Duo with additional links for information and assistance. After reading the introductory text, choose “Start Setup.”
3. Choose Security Key.
4. You will be prompted to enroll your key. Ensure your browser allows pop-up windows allowed and select "Continue."
5. A pop-up window will appear with steps to enroll your key. Insert your key and follow the prompts. Depending on your operating system and browser, the prompts will vary.
6. After successfully enrolling, you will receive a Success message for a short time before the window closes automatically.
7. On the final screen, select "Finish Enrollment."
8. After finishing enrollment, you’ll be congratulated.
Signing In with Duo
Signing in to Duo Central and Testing
Authenticating with Duo is simple and easy to verify everything is working as intended. Duo provides a portal to log in that can be used for verifying your authentication method. The steps provided to sign in to Duo Central are similar to web-based applications including Office 365, and SalesForce.
1. To test your authentication, use the Duo Central Portal.
2. You should be redirected to the myCCC portal to log in.
a. if myCCC does not open, please contact the ITS Help Desk.
3. After signing in, you will be redirected to authenticate with Duo.
4. Depending on your default authentication method, the prompt you are given to authenticate may look different from the examples below.
a. To create or adjust the default method of authentication, choose "Other Options." (Step 5)
5. After successfully authenticating, you’ll have the option to trust the browser and continue to the application.
a. Trusting the browser will not work for Incognito browsers or browsers with cookies disabled.
6. If you need to change your authentication method, choose “Cancel” then “Other Options.”
a. Your options depend on previously set up authentication methods and will look different from the example below.
b. Before making any changes, you will be required to authenticate with your existing method of authentication.
Signing in to Windows
The first-time logging into a Windows PC with Duo requires the computer to be connected to the internet. If offline access is not set up for future logins (step 6) an internet connection is required on every login.
- On-site CCC computers should be connected through the wireless or plugged into the network by default.
- After a computer turns on or restarts there may be a 1-to-2-minute delay before the network is ready for Duo to authenticate.
- Off-site CCC computers must be connected to the internet before logging in.
- Network options can be adjusted pre-login after pressing CTRL+ALT+DEL and choosing the network icon on the bottom right of the login screen.
Logging In
1. Log in to Windows using your Comet ID and password.
2. After logging in with your Comet ID and password, a Duo screen will pop up to authenticate.
a. You will have 120 seconds (2 minutes) to authenticate before Duo times out. If Duo times out before you have authenticated, you will need to wait up to 7 minutes for Windows to revert to the login screen.
b. Note: If you have the Duo App with Push enabled, you will automatically receive a push notification. If you do not receive a push notification, verify the Duo App has not gone to sleep.
3. Choose an option to authenticate.
a. Duo Push – Requires Duo Mobile App.
b. Passcode – SMS/Texts, Duo Mobile Code, and USB Security Key.
c. Note: “Call Me” is disabled and unavailable due to incompatibility with our environment.
4. After choosing an authentication method, you’ll be given the following prompts:
a. Approve or Deny the Push Notification
b. Enter the SMS Text Code OR enter the code from your Duo Mobile App.
c. Insert your Security Key and press the lit-up button on the USB.
5. When signing in to your computer, you will have the option to “Remember me for 5 hours.”
a. Choosing “Remember Me” will not prompt for Duo authentication for 5 hours upon successful login. Certain actions will reset the prompt and force you to authenticate again:
Restarted the computer, logged out completely and logged in (Locking does not count), Changed networks (i.e., a laptop that has been removed from a dock)
b. Note: Remember me is not available for Remote Desktops or Virtual Desktops.
6. On first-sign in, you’ll be prompted to create offline login access. Follow the steps in the next section to set up offline access.
Signing in to Webmail
1. Navigate to the Employee Webmail page found in the "Faculty & Staff" dropdown menu of the CCC website.
2. Login using your Comet ID and password.
a. If you have been enrolled in Duo but have not yet set up your multifactor, you will be prompted to finish enrollment. Follow the steps in the section above on enrolling in Duo through webmail.
2. Upon successful sign in, you will be prompted to verify your identity with Duo.
3. Depending on your method of authentication, the prompts will vary slightly.
a. Duo App - Select "Send me a Push" and approve the notification on your mobile device. If the push does not arrive right away, open the App to ensure it has not gone to sleep.
b. Text Code - Select "Enter a Passcode" under the mobile device. At the bottom of the box will be the option to "Text me new codes." Select this prompt and enter the code received to login.
c. Hardware Token - Insert your Hardware Token into a USB port and wait until it lights up. When the token lights up, press the capacitive screen and the code should autofill. If the code does not autofill, place your cursor in the input field and try again.
NOTE: Hardware tokens are supplied by ITS only and cannot be self registered.
d. Security Key - Select "Use Security Key." A new window will appear with setups to insert your key and complete authentication. Follow the steps to login.
NOTE: Security Keys are self-enrolled by users, and cannot be used for Windows logins.
4. After confirming your identity using Duo, you will be signed in to Webmail.
Offline Access
Activating Offline Access for Windows Devices
After you have enrolled for Duo, you will be prompted to set up offline access on the first sign-in. Offline access ensures you can still log into your computer even if there is no internet connection available. Without offline access enabled, your login will fail if Duo cannot connect to the internet.
Requirements:
- Offline access requires either the Duo mobile app or a USB Security Key.
- Offline access does not work with SMS text codes.
Notes:
- Offline access is highly recommended to be set up for your office computer.
- If you take your laptop home, it is critical to enroll your laptop for offline access.
- There is a limit to the number of users that can enroll in offline access per computer.
- Shared computers (IT, Financial Aid, Registration, Security, etc.) should be enrolled for offline access by the most frequent users in case of an internet outage.
Enrolling in Offline Access
1. After successful authentication with Duo, you’ll be prompted to enroll in Offline Access if you have not already
2. Select either Duo Mobile Password or Security Key and choose “Activate Now.”
a. Duo Mobile Passcode requires the Duo Mobile App.
b. If you do not want to set up offline access, choose “Enroll Later.”
c. Note: You will be prompted every single time to enroll in offline access if you do not enroll.
3. Depending on your choice, you’ll have two different enrollment steps.
a. Duo Mobile Passcode (Step 4).
b. Security Key (Step 5).
4. Using the Duo Mobile Passcode:
a. You’ll be prompted to scan a QR code using your mobile device.
b. You must use the Duo app, other authentication apps (Google, Authy, Microsoft Authenticator, etc.) will not work.
c. Open the Duo Mobile App and choose “Add” in the top right and choose “Use QR Code.”
d. Scan the QR code. You may be prompted to give the Duo access to your camera to scan the code.
e. The scanned QR code will generate an account in the list and display a code.
f. To finish enrollment and login, enter the code from the account on your computer and choose “Activate Offline Login.” If the code is correct, you’ll be immediately logged in.
5. Using a USB Security/Hardware Key:
a. ITS does not provide Security Keys. Please speak with your supervisor to work with ITS.
b. Remote users may experience issues being able to enroll with a Security Key and could be required to physically be at the computer to enroll.
c. Duo only supports certain Security Keys and supported protocols, using a personal Security Key may cause issues or may not be compatible.
6. Insert the Security Key into the computer. Yubikeys will light up when they are plugged in and ready to go.
7. Once the key is recognized, you will be prompted to tap to enroll the device.
a. Most Security Keys have a gold capacitive area on the face of the USB that can be tapped when ready. Some Security Keys may have a fingerprint reader, the capacitive area is on the side.
b. If your Security Key is not already inserted, or your key had an issue and was unable to be detected, you’ll be prompted to insert the USB Security Key with a “No Security Key Found” message. Insert/Reinsert the key and try again.
8. After enrolling your USB Security Key, to finish enrollment and login, choose “Activate Offline Login.”
Security Keys
Security Key / Hardware Key Information
Note: USB Keys are not provided by ITS. Please speak with your supervisor to work with ITS to purchase a key. Hardware keys require ITS assistance in enrolling to be used with Windows Logins.
Coconino Community College uses YubiKeys as a preference. YubiKeys work as both Hardware Keys for Windows Authentication and Security Keys for web-based applications.
Security Keys are best used in addition to the Duo Mobile app or SMS Text messages. ITS recommends enrolling at least two authentication methods with Duo in situations where one method may not be available.
Treat your Security Key like your personal keys. Refrain from keeping your Security Key plugged into the computer after authenticating.
Remote users may experience issues being able to enroll with a Security Key and could be required to physically be at the computer to enroll. Duo only supports certain Security Keys and supported protocols, using a personal Security Key may cause issues or not be compatible.
Frequently Asked Questions
Troubleshooting / Errors
Why am I getting a Browser out of Date Message?
When logging in Duo checks your browser's security patch version to ensure it's up to date.
If your browser or device needs an update you may receive a message to check.
There was an error communicating with Duo Authentication server. Please try again. (12007)
Verify your device is connected to the internet. Duo requires an active internet connection if a user has not enrolled in Offline Access. Ensure you are not behind a VPN or Proxy that might be blocking the connection.
If you recently restarted your computer, it may take up to 2 minutes before your device is fully connected.
Even if your device is showing no internet, navigating, and selecting the internet icon on the lock screen will display the active status.
Reconnect your account, Account invalidated within Duo App
You will need to sign in to a web-based Duo application (Duo Central) and follow the prompts to set up a new device. If you only have the Duo App added and no secondary method (Text/SMS or Security Key) you will need to contact ITS.
Anomalous Request Detected Error affecting Duo Login
Logging in multiple times too quickly from different devices or triggering an unusual activity detection will cause your login to fail. Please try again after a couple of minutes. Unusual activities include logging in from devices in different locations, time zones, or countries blocked by Duo. If the issue persists, contact ITS.
Login timed out or The Requested Timed Out when signing in to Windows using Duo
When the Duo authentication screen appears upon a Windows login, you have 2 minutes to successfully authenticate. If you do not authenticate using Duo within 2 minutes, you will need to wait 7 minutes for Windows to timeout. After 7 minutes of no activity, the screen will revert to the login, and you can try again.
This error most commonly occurs due to text/SMS messages being delayed. If you have a slow internet connection, this can also occur using the app.
If you do not have anything open on the computer, you can also restart the computer to quickly reset the timer.
