Introduction

2-factor Authentication, also known as Multi-Factor Authentication is a security measure that effectively proves that the person accessing your accounts is you, and not someone who has fraudulently obtained your password. Enrollment in Duo 2-factor authentication (2FA) is required to log into many Virginia Tech Web-based systems. To use websites and services that use Virginia Tech’s Login service, you are required to authenticate with a second factor.

Contents

Setup and Use

• How Do I Start Using 2-factor Authentication?
• How Many Devices or Factors Should I Enroll?
• What are all the options for devices I can enroll, and how do I choose between them?
• How Do I Add a New Device?
• How Do I Get and Print Backup Codes from the Virginia Tech Web Site?
• How Do I Reactivate the Duo Mobile App?
• What Do I Need to do if I Got a New Phone with the Same Phone Number?

General Questions

• Can I Use 2-Factor without a Mobile Device?
• How Do I Log In without My Phone or Any 2-Factor Device if It Is Lost, Forgotten, Broken or Unavailable?
• How Can I Log In to a Connected Computer While My Phone is Not Connected to the Internet? (especially relevant for International / Overseas connections)
• What Do I Do about Duo Mobile App Connection Issues?
• What Do I Do when the Duo Window in the Browser Doesn't Load or Is Blank?
• What Are the Supported Browsers?
• How Do I Remove or Delete an Authentication Device from My Duo Account?
• What if I Don't Want the Duo App on My Phone?
• How Do I Reactivate Duo Mobile When I Can't Scan the QR Code?
• How Can I Log in if the Account Was Accidentally Deleted or Removed from the Duo App?
• What Do I Do if I Accidentally Deleted or Removed My Second Factor Device?
• Why Do I Get the D-100 Incorrect Passcode or Token Out of Sync Error Message?
• How Do I Rename a YubiKey, D-100, or Software Token?

Related Links

• Documentation from Duo Support
• Understanding YubiKey and D-100 Hardware Tokens for Duo 2-Factor Authentication
• Logging into a Public Computer Using 2-Factor Authentication with Duo
• Using Duo 2-Factor Authentication
• Enrolling, Adding, Managing, or Removing a Duo 2FA Device

How Do I Start Using 2-factor Authentication?

The first time you attempt to access a Virginia Tech service that requires 2-factor authentication, Duo will direct you to enroll a device that you can use for authentication using the interactive Duo web-based prompt. You won’t be able to complete the login process without completing this step first. Follow the on-screen prompts to set up your Duo authentication device.

As a new student or employee, after you create your VT Username you will automatically be directed to the Account Manager application (accounts.it.vt.edu) where you will be able to enroll in Duo.

How Many Devices or Factors Should I Enroll?

Enroll a minimum of two devices. That way if one is unusable, you can use the backup to continue accessing Virginia Tech 2FA websites.

What are all the options for devices I can enroll, and how do I choose between them?

During the Login process, Duo will select the most secure option based on your available devices and configuration. Listed below are the allowed Duo 2FA methods:

• Duo Mobile app with verified push
• Duo Mobile app generated codes
• Biometric Authenticators
  • Apple Touch ID
  • Apple Face ID
  • Windows Hello
  • Android Biometrics
• Browser based passkeys
  • Chrome
• Security keys / passkeys
• Hardware tokens
• Software tokens
  • Google Authenticator
  • Microsoft Authenticator
  • Apple Keychain
• YubiKey passcodes
• Hardware token passcodes

Top of the page

How Do I Add a New Device?

1. When logging into a Virginia Tech 2FA protected website, enter your VT Username and Passphrase.
   1. When the Duo login screen is presented, click on "Other options." NOTE: if the 2FA screen is bypassed, open a new Chrome incognito / Edge inPrivate / Firefox private window and use that to log into the website you need to visit. This will allow you to see the options for managing devices.
2. Follow the directions at Duo’s Add or Manage Devices After Enrollment.

Top of the page

How Do I Get and Print Backup Codes from the Virginia Tech Web Site?

1. Log in to the Virginia Tech accounts site at accounts.it.vt.edu.
2. Use the left hand menu to navigate to the 2-Factor page.
3. In the middle of the page, click Generate passcodes.
4. To confirm that you understand the warning displayed, click Generate.
5. On the webpage, click Print.
6. Your printer settings will appear. Select the printer you want to use, and then click OK.
7. Store the printed paper in a secure location, and use a pencil or pen to mark when you use each code. Each code can only be used once.
8. Any Duo passcodes you previously printed from this Virginia Tech website will no longer work.
9. Note that you have to be able to log into the accounts page in order to print backup codes. If you cannot authenticate with any second factor, follow the instructions at Lost, Forgot, Broke, or Unavailable 2-Factor Device instead of these instructions.

Top of the page

How Do I Reactivate the Duo Mobile App?

1. In your browser, open a new Chrome incognito / Edge inPrivate / Firefox private window.
2. When logging into a Virginia Tech 2FA protected website, enter username/password normally.
3. When the Duo screen with the three-digit code is presented, click on Other options.
4. At the bottom, click on Manage Devices.
5. Complete the authentication with your second factor to proceed.
6. Follow the instructions on the Reactivate Duo Mobile for an Existing Device page.

Top of the page

What Do I Need to do if I Got a New Phone with the Same Phone Number?

• If you want to use a new phone that has the same phone number as the old phone:
  
  
  1. Install the Duo Mobile app on the new phone from the Google Play Store or Apple App Store.
  2. Follow the instructions at Reactivate Duo Mobile for an Existing Device.

Top of the page

Can I Use 2-Factor without a Mobile Device?

Yes. Duo supports several methods. Also see How Many Devices/Factors Should I Enroll?

Top of the page

How Do I Log in without My Phone or Any 2-Factor Device if It Is Lost, Forgotten, Broken or Unavailable?

If you temporarily misplaced, broke, or otherwise can't use your 2FA device to authenticate:

1. Use your additional enrolled device, if applicable.
2. Otherwise, you must call 4Help at 540-231-4357 to get a bypass code. Bypass codes are not given online or by email.

Top of the page

How Can I Log in to a Connected Computer While My Phone is Not Connected to the Internet? (especially relevant for International / Overseas connections)

When outside of the continental United States, 4Help highly recommends Authenticating with a Passcode from Duo App, using Backup codes from the Virginia Tech Website, or using a previously enrolled method.*

(If you do not have access to any method of authenticating with a second factor, follow the instructions at Lost, Forgot, Broke, or Unavailable 2-Factor Device.)

If you anticipate needing to authenticate without internet or cellular service in the future, 4Help advises doing at least one of the following when you are on campus:

• Install the Duo Mobile app by following the instructions at Duo Mobile.
  • Anytime you are without internet or cellular connectivity, you can start the Duo Mobile app and generate a passcode by following the instructions at Duo Mobile Passcode. Even with your smartphone or tablet in airplane mode, you can start the Duo Mobile app and generate passcodes.
• Save (or write down on a piece of paper) a list of 10 codes generated by following the instructions at Print Passcodes from Virginia Tech Web Site.

Top of the page

What Do I Do about Duo Mobile App Connection Issues?

Occasionally, you may experience connectivity issues such as not receiving Duo Push notifications or timeout errors. This problem is often resolved by refreshing the Duo Mobile app. To do that, click the circular arrow in the upper right corner of the app.

Top of the page

What Do I Do when the Duo Window in the Browser Doesn't Load or Is Blank?

Go to the Duo Security Status webpage, and look for any interruption of service. If that webpage does not list any issues, then one of these conditions may be causing the problem:

• You have a firewall installed on your device preventing your browsers from reaching Duo.
• You have Parental Controls or other restrictions on your device preventing your browsers from reaching Duo.

If you have difficulty correcting these issues, contact 4Help by clicking Get Help at the top of this page or at http://4help.vt.edu.

Top of the page

What Are the Supported Browsers?

The currently supported browsers can be found on the supported browsers page.

Top of the page

How Do I Remove or Delete an Authentication Device from My Duo Account?

1. Open a new Chrome incognito / Edge inPrivate / Firefox private window.
2. When logging into a Virginia Tech 2FA protected website, enter username/password normally.
3. When the Duo screen is presented, click on Other options.
4. At the bottom, click on Manage Devices.
5. Complete the authentication with your second factor to proceed.
6. Follow the instructions in the Remove Device section on the Rename or Remove a Device page.

Top of the page

What if I Don't Want the Duo App on My Phone?

Hardware fobs and tokens provide this functionality without adding an app to your phone.
Also see How Many Devices/Factors Should I Enroll?

Top of the page

How Do I Reactivate Duo Mobile When I Can't Scan the QR Code?

To activate Duo Mobile when you cannot get the QR code to scan, or when you only have access to a single screen or device, follow the instructions at Duo Mobile … search for “Reactivate Duo Mobile for an Existing Device

Top of the page

How Can I Log in if the Account Was Accidentally Deleted or Removed from the Duo App?

• If you have another *previously-enrolled* device, use that for Duo login and re-enroll the deleted account:
  
  
  1. In your browser, open a new Chrome incognito / Edge inPrivate / Firefox private window.
  2. When logging into a Virginia Tech 2FA protected website, enter username/password normally.
  3. When the Duo login screen is presented, click on Other options.
  4. On the ‘Other options to log in’ screen, at the bottom, click on Manage Devices.
  5. Use the Duo Manage Devices screen to delete the second factor that you accidentally deleted the account on by following the instructions at Rename or Remove a Device.
  6. Add that device to your Duo account by following the instructions at Add or Manage Devices After Enrollment.
  7. Note that if you are overseas, these steps may not work. For more information, see Authenticating without Internet, Network, or Cellular Service (International / Overseas).
• If you do not have any previously enrolled second factor devices:
  
  
  1. You must *call* 4Help at 540-231-4357 and ask for a bypass code over the phone, since bypass codes cannot be sent via email or web browser. You will be required to confirm your identity through a video call.
  2. Once you log in using the bypass code, enroll an additional device by following the instructions at Add or Manage Devices After Enrollment.
  3. To avoid this problem in the future, we strongly recommend enrolling at least two devices.

Top of the page

What Do I Do After I Accidentally Deleted or Removed My Second Factor Device?

• If you have another *previously-enrolled* device, use that for Duo login and re-enroll the deleted device:
  
  
  1. In your browser, open a new Chrome incognito / Edge inPrivate / Firefox private window.
  2. When logging into a Virginia Tech 2FA protected website, enter username/password normally.
  3. When the Duo login screen is presented, click on Other options.
  4. Enroll the device by following the instructions at Add or Manage Devices After Enrollment.
  5. Please note that if you are overseas, the following steps may not work. For more information, see Authenticating without Internet, Network, or Cellular Service (International / Overseas).
• If you do not have any previously enrolled second factor devices:
  
  
  1. You must *call* 4Help at 540-231-4357 and ask for a bypass code.
  2. Once you log in using the bypass code, enroll an additional device by following the instructions at Add or Manage Devices After Enrollment.
  3. To avoid this problem in the future, we strongly recommend enrolling at least two devices.

Top of the page

Why Do I Get the D-100 ‘Incorrect Passcode’ or ‘Token Out of Sync’ Error Message?

Tokens can become out of sync when the token is used to generate multiple codes but is not used to authenticate. Pressing the button repeatedly without using a code to log in may cause problems.

To fix this problem, follow the directions at Resync D-100.

Top of the page

How Do I Rename a YubiKey, D-100, or Software Token?

Yubikeys can be renamed by selecting "Other options" and "Manage Devices" during Duo login. The Duo system does not allow you to rename any D-100 or software token since each token is assigned a unique set of characters.

Top of the page

Search words: two-factor, two step, multi-factor, 2FA, sign in, Duo, authentication, log in, login, MFA

Top of the page