Duo SecurityTwo-factor authentication for Rockefeller applications

Duo Mobile is a mobile application that you install on your smartphone or tablet to generate passcodes for login or receive push notifications (recommended) for easy, one-tap authentication on your mobile device. It works with Duo Security's two-factor authentication (2FA) service to make your logins more secure.

If you are new to Rockefeller or are an existing employee who has never enrolled in Duo, there are two ways to create a Duo account:

1. You will automatically receive an enrollment email from Duo Security (no-reply@duosecurity.com). Use the enrollment link and follow the instructions to set up your account.
2. When you try to log in to an application that is protected by Duo, you will see a prompt to set up your account and enroll your device. Click the Start Setup button and follow the instructions. You'll have 30 days to complete your enrollment.

Duo gives you several authentication options, including sending a push or calling. You can set Duo to automatically use a preferred authentication method for each device that you have enrolled. To open the Duo prompt, log in to any Duo-protected application, such as VPN. When the prompt appears, select Settings > My Settings & Devices. For detailed instructions, visit the Duo website.

Have a new phone? You'll need to enroll it before you can use Duo on it. Open the Duo prompt by logging in to a Duo-protected application, such as VPN. When the prompt appears, select Settings > Add a new Device. For detailed instructions, visit the Duo website.

When logging in to an application that is protected by Duo, you will still enter your username and password. After inputting your login information, Duo requires you to approve a Duo Push notification or other method of two-factor authentication. Duo does not replace or require you to change your username and password — think of Duo as a layer of security added to your pre-existing login method. Watch the video below to see Duo Push in action.

Authenticate with Duo Push on iPhone0:44

If you have a smartphone or tablet, we recommend Duo Push, as it is quick, easy-to-use, and secure. See an introduction to Duo Security and a demonstration of Duo Push in the short video below.

If you have created custom email filters or rules, you may need to check your junk or spam folder for the enrollment email.

Duo Push authentication requests require a minimal amount of data — less than 2KB per authentication.

There are several reasons this could be happening. Please try the following troubleshooting suggestions:

• Make sure your enrolled device has a cellular network or WiFi connection.
• Open the Duo Mobile app when you authenticate.
• Ensure that you have notifications enabled for Duo.
• Reboot your phone.
• Try the additional troubleshooting steps for iPhone or Android provided on the Duo website.
• If the above solutions don't work, try using another authentication method, such as passcodes provided in the Duo Mobile app.

Yes. In the Duo Mobile app, generate a passcode by tapping the key icon. The passcode will appear underneath. If you have a hardware token, you can press the button. If you know in advance that you will have no signal or WiFi access, test one or more of these options beforehand. See the Duo Knowledge Base article for more information.

Please contact the IT Help Desk immediately by phone at (212) 327-8940 or email.

No. Your passphrase is only verified by your organization and is never sent to Duo. Duo provides only the second factor, using your enrolled device to verify it's actually you who is logging in.

No. The Duo Mobile app has no access to change settings or remotely wipe your phone. The visibility Duo Mobile requires is to verify the security of your device, such as OS version, device encryption status, and screen lock. This is used to help recommend security improvements to your device — you are always in control of whether to act on those recommendations.

If you get a new phone or factory reset your phone: reinstall the Duo app on the new phone and follow these instructions to activate Duo via the RUNet Portal.

If you get a new SIM card but are using the same phone, your Duo app will still work.

To authenticate from the Duo app on your old phone while you're setting up the new one:

1. Launch the Duo Mobile app on your old device and tap the key icon or "Show" to reveal the passcode.
2. Sign in to Pulse Secure and, when prompted, choose Enter a Passcode as your authentication method.
3. Enter the passcode from Duo.

Bypass codes or hardware tokens are available as an alternative to the Duo App.

• A bypass code is a one-time code that can be generated for you by contacting the Help Desk during normal business hours. Once generated, it can be used for 1 week.
• A hardware token is a physical device you carry to authenticate your identity using a passcode. Hardware tokens can be requested and enrolled by contacting the Help Desk. Tokens that are lost or not returned upon leaving the university will incur a charge.

Yes. All international phone numbers are supported in Duo using the following format: Country code + National Destination Code + Phone Number. Example, in Switzerland: +41 33 123456789.

Duo Mobile only accesses your camera when scanning a QR code during activation. You can also receive an activation link via email.

No. The Duo app is installed on a mobile device such as a phone or tablet, not a laptop.

Your Duo will automatically lock after 10 failed login attempts. The lockout will expire after 15 minutes.

Make sure you entered the correct code and that your token is right side up. It is possible that your token is out of sync. Press the green button to turn off the Duo token, press it again, and enter the newly displayed code to log in. If your login fails, repeat this process two more times. Contact the IT Help Desk at x8940 if you still need help.

If you have not used Duo in over 30 days or made several failed attempts to log in, you may need to resynchronize your Duo account. Close the mobile app on your smartphone, then reopen it and enter the passcode. You may need to repeat this process once more before logging in successfully. Contact the IT Help Desk at x8940 if you still need help.

Login credentials are more valuable than ever and are increasingly easy to compromise. Over 90% of breaches today involve compromised usernames and passwords. Two-factor authentication enhances the security of your account by using a secondary device to verify your identity. This prevents anyone but you from accessing your VPN account and the Rockefeller network, even if they know your password.

What is Two-Factor Authentication? (2FA)

Yes, but there is a limitation for iOS devices. Android users can select the type of Duo authentication to use, such as Send Me a Push, Call Me, or Enter a Passcode. For iOS users, Pulse Secure defaults to using Push notification to the primary phone on file. Users with a Duo hardware token should click "Click here if you need to enter a second factor passcode" under the Sign In button before tapping Sign In. iOS users without a hardware token or a mobile device registered with Duo who use Push or the Duo Security mobile application will not be able to connect using the Pulse Secure mobile application on their iOS device.