Multi-Factor Authentication Enrollment and Configuration Guide
Step 1: Decide how you want to authenticate
Before enrolling you should decide which type of device you would like use for authentication. Don’t worry – this is not a permanent decision. After enrolling your first device you may add or remove as many devices of each type as you like as you discover the mechanism that works best for you.
- Mobile Phone or Tablet – Using a mobile phone or tablet will be the best choice for most people. The Duo App installed on your device will pop up a prompt while you are logging in. Pressing the green OK button is all that needs to be done to complete the authentication process. Detailed instructions and pictures for all supported devices is available in the Duo guide.
- Hardware Token – Those who do not want to use a mobile device are welcome to request a hardware token. This token displays a random number that is constantly changing. Each time you authenticate you will simply enter the number displayed on the device into the computer. More detail on this option is available in the Hardware Token section of the Duo guide.
- Third-Party U2F Tokens – If you own a third-party U2F token like the popular YubiKey you may make use of that for authentication. And of course, there is more detail in the U2F section of the Duo guide.
Step 2: Request enrollment
Once you have decided how you want to authenticate you need to let CCIT know that you would like to be enrolled with the service submit this request form. After receiving your request CCIT will add your account to the Duo service, a process that usually takes 1-2 business days to complete. What happens next depends on the authentication mechanism you have selected.
- If you selected Duo Mobile or Third-Party Token you will receive an email with a link that allows you to start the enrollment process.
- If you decided to start with a Mines-provided hardware token you will receive an email when the token is ready to be picked up at the CCIT Technology Support Center (CT156). There is nothing more you need to do. We will take care of everything while you are collecting your device.
Step 3: Install the Duo Mobile App (Mobile Devices only)
If you will be using a mobile device (i.e., a phone or a tablet) you need to install the Duo Mobile App for your device. Duo provides Apps for iOS, Android, and Windows Phone through your operating system’s application store.
Step 4: Enroll your device (Mobile Device or U2F Token only)
Once the Duo Mobile App is installed you are ready to enroll your device. Look for the enrollment email in your Mines inbox. Please look carefully at the email and URL embedded in the message (see the following example). If you did not request enrollment, or if the URL does include the HTTPS protocol and the domain “duosecurity.com,” do not respond to the message but do contact CCIT immediately (303.384.2345). If the enrollment email does contain those elements, paste the link into your web browser to visit the page.
After following the link, you will be presented with a webpage that will guide you through the process of configuring your device. The process will be a little different depending on the type of device you are adding but, in all cases, it should only take a minute or two.
Step 5: Give MFA a Test Drive
Multi-factor protection for your account will begin as soon as you have completed the enrollment process. You should confirm the process works by trying to authenticate to one of the protected services (Canvas makes a good test case).
For most people this is all you should need to do. If you have any problems please check our MFA Frequently Ask Questions page or contact the Technical Support Center (CT156 or 303.384.2122) and we will be happy to help.
How do I enroll in (and configure) multi-factor authentication?
Multi-factor request form (please read the enrollment info, above, first)