Skip to main content
Technology at SCU

Duo Help Guides

On this page, you can find the following Duo Help Guides:

Duo Universal Prompt Login Options
Deciding Which Duo Options To Use
First-time Enrollment In Duo
Add Or Manage Devices After First-time Enrollment
"Trust This Browser?"
I Have A New Phone
Using Duo When Traveling
Requesting a Bypass Code

Duo 2FA at SCU supports the following methods:

Touch ID
Security Key
Duo Mobile Push
Hardware Token Passcode
Text Message (SMS) Passcode
Phone Call

The way each 2FA option works is described below, from the most secure (Touch ID) to the least secure (Phone Call).


Touch ID: Touch your Mac's Touch ID sensor when prompted to log in to the application. To use Touch ID with Duo, you must have:


Security Key:  Plug a Security Key into a USB port, then tap or press it to verify your login. To use a security key with Duo, you must have:

When you first register a Security Key, you may see a browser-specific dialog screen asking you to share the security key's make and model with Duo. You should accept/confirm this dialog before you can proceed with registration. No personal information is shared with Duo when this is done.

Need a Security Key? Employees can request a Security Key by contacting the Technology Help Desk.


Duo Mobile Push:  Receive a login request on your smartphone or tablet with Duo Mobile installed. Review the request and tap Approve to log in to the application. The Duo Setup Quickstart gets you started with the Duo Mobile app.


Hardware Token Passcode:  If you have a hardware token that generates a passcode, enter that passcode into the Duo Prompt, then click or tap Verify to log in.

Need a Hardware Token? Employees can contact Information Services at 408-554-4581 to request one.


Text Message (SMS) Passcode:  Log in using a passcode received from Duo in a text message. The Duo Prompt will show that a text message was just sent to you with a passcode. When you receive the message, enter that passcode into the Duo Prompt, then click or tap Verify to log in.


Phone Call: Answer the phone call from Duo and follow the voice instructions to log in.

Note: This is the least-secure option, and it is significantly more expensive than any other verification method. Because of the cost incurred to the university, using a Phone Call should only be considered as an option of last resort.

In most cases, Duo Mobile Push is the best way to authenticate -- it’s quick and it’s secure. Read more from Duo

Option Network Connection Advantages Disadvantages
TouchID WiFi or wired connection
  • Most secure option
  • Can use in any location, even when traveling if you plan on bringing your Apple laptop with you
  • Very quiet / non-disruptive
  • Tied to a specific devices that supports TouchID (Macbook Pro or Macbook Air)
  • Tied to a specific browser (Chrome)
  • Does not work as a 2FA method for SCU VPN
Security Key No network required
  • Use in any location
  • Can use while traveling
  • Very quiet / non-disruptive
  • Tied to specific browsers
  • Small device is easier to forget than a mobile phone
  • Requires an accessible USB port each time you need to authenticate using Duo
  • Does not work as a 2FA method for SCU VPN
Duo Mobile Push Cellular or WiFi
  • Works with any browser
  • Works in any location
  • Works with your Apple Watch
  • With the Duo Mobile Passcode option, use when traveling or out of cellular service
  • Works as a 2FA method for SCU VPN
  • None
Hardware Token Passcode No network required
  • Works in any location
  • Can use when traveling
  • Very quiet / non-disruptive
  • Works as a 2FA method for SCU VPN
  • Small device is easier to forget than a mobile phone
Text Message (SMS) Passcode Cellular or WiFi
  • Use with any browser
  • Use in any location
  • Works as a 2FA method for SCU VPN
  • Text message rates apply to employee or student
  • Incurs a higher cost to Santa Clara University
  • Text message notification sound might be disruptive in some environments
Phone Call

Mobile phone - cellular service

Landline - telephone service

  • Use with any browser
  • Incurs the highest cost to Santa Clara University
  • If landline, tied to a specific location
  • Can't use method when traveling (landline) or without service (mobile phone)
  • Ring volume might be disruptive in some environments
  • Does not work as a 2FA method for SCU VPN

Don’t have a smartphone?

The most convenient and easy way to authenticate is by tapping the notification that pops up in the Duo Mobile smartphone app. However, the app is currently only available for Apple and Android smartphones. If you have a different type of phone, you will not be able to take advantage of the Duo Mobile app.

There are several options available for people in this situation:  use a Security Key, use a Text Message (SMS) passcode, or receive a voice call confirmation. Receiving a phone call is not recommended (except as a backup-of-last resort) as the cost to the University is significant.

This section is for first-time enrollment in Duo. If you have already enrolled in Duo, see the Add Or Manage Devices After First-time Enrollment section to add or update your enrolled devices. 


Select your enrollment options
Review the Duo options shown in the section above, Deciding Which Duo Options To Use. Select a primary option (Duo Mobile Push is recommended), and select a back-up option that works for you (like a Duo Mobile on a tablet, or a phone call to a landline).

To get started with the Duo Mobile App...
The Duo Setup Quickstart will get you started with the Duo Mobile app.


Don’t have a smartphone, or don’t want to use the Duo Mobile App?
If you don't have a smartphone, or if you don't want to use the Duo Mobile app, follow the detailed instructions in the Duo guide to set up other options:

Step 1: Introduction
Go to the MySCU Login portal. Click on a tile for a Duo-protected application (such as Google Workspace), and you will be prompted to set up your Duo account.

Step 2: Choose Your Verification Method
The verification methods are shown in the Duo guide, with the most secure options at the top of this list.

Step 3: Add Your Chosen Method
Once you choose the method for to verify your identity, follow the step-by-step instructions in the Duo guide to add that method.

Step 4: Add a Backup Method
Add a second verification method that you can use as a backup if the first method you added isn’t available, like if you lose or forget your phone and need to log in with Duo, or if you want to access an application from a different MacBook that the one you used to set up Touch ID in Duo.

Once you’ve added a backup method, you’re at the end of the Duo setup process. Click Log in with Duo to log in to the application using the Duo method you just added.

From the Duo Universal prompt, you can add additional verification methods, manage your existing devices, or re-activate Duo Mobile if you’ve changed phones.

On the MySCU Login portal, click on a tile for a Duo-protected application (such as Workday). If you're not prompted for Duo, try again using a Chrome Incognito window.

At the Duo prompt, select Other options, and then select Manage devices.

To continue to the device management portal, you’ll need to verify your identity, just as you do when logging in to an application protected by 2FA. Once you’re verified, you can see and manage all your registered devices. 

Follow the detailed steps in the Duo guide to add a new device, or to rename or remove an existing device.

When presented with the Duo authentication prompt, you will be asked whether you want to “Trust this browser?”  If you select the option Yes, trust browser, you will not receive Duo prompts for additional SCU SSO applications for 12 hours, except in certain circumstances described below. For example, if at 8am you get prompted to authenticate to Duo to access Gmail, and you check the box to trust the browser, you will be able to open Workday that afternoon on the same computer and browser and not get a Duo prompt.


So what are these certain circumstances referred to above?

  1. The VPN will always prompt you to authenticate with Duo.
  2. It is device and browser specific, not account specific. This means if you access Workday on your tablet and use the “Trust Browser” feature, if you then use your computer to access Workday later the same day, you will be prompted with Duo again. Similarly, if you use Firefox on your computer to access Workday in the morning, you will be prompted by Duo again if you switch to Chrome later in the day.

  3. If you have configured your browser to deny third-party cookies or to prevent cross-site tracking, the “Trust Browser” feature will not work. Instructions from Duo for how to add an exception in your browser. 

IMPORTANT:  ​​Remember not to not select this option unless you are using a computer you own or control. Do not use this option on a lab workstation or a shared computer.

If you have replaced the phone you activated for Duo Mobile Push, or if Duo Mobile Push stops working, you can get it working again through self-service. If a Duo Mobile Push authentication times out you'll see the I got a new phone option shown in the Universal Prompt. Click or tap that link to begin the process to re-activate your phone. 

If you are still using the same phone number, click or tap Text me a link. You’ll use the reactivation link to get Duo Mobile working again.

If you have a new phone number, click or tap Continue to proceed to the Duo device management portal. From there, you can complete the steps to add your new phone number and set up Duo Mobile Push on the new phone so you can use it to log in with Duo.

The Duo guide shows the detailed steps to follow, to reactivate Duo Mobile. 

NOTE: If you used the old phone just to receive Duo voice calls or text messages, and you are keeping the same number, you don't have to do anything; Duo will still work.

There are several options for using Duo while traveling:

Bypass Code: In the event that you've lost or left your phone or hardware token at home, you may have no way of authenticating to Duo. You can get a single use, temporary bypass code from either the Technology Help Desk or by using the Bypass Code Generator. Note, you must have previously set up alternative (non-SCU) contact information to use the Bypass Code Generator.

Once you have your code, click or tap on Other options, then select I have a bypass code in the Duo prompt. Type in the bypass code, then click or tap Verify to log in.


Security Key: If you don't have a mobile phone, or don't want to enroll one, you can enroll a Security Key as a verification method. Bring your Security Key with you to authenticate when traveling. Employees can request a Security Key by contacting the Technology Help Desk.

When you first register a Security Key, you may see a browser-specific dialog screen asking you to share the security key's make and model with Duo. You must accept/confirm this dialog before you can proceed with registration. No personal information is shared with Duo when this is done.

 

In the event that you've lost or left your phone or hardware token at home, you may have no way of authenticating to Duo.

You can get a single use, temporary bypass code from either the Technology Help Desk or by using the Bypass Code Generator. You must have previously set up alternative (non-SCU) contact information to use the Bypass Code Generator.

Once you have your code, click or tap on Other options, then select I have a bypass code in the Duo prompt. Type in the bypass code, then click or tap Verify to log in.