Signing In with Two-Factor Authentication
Your administrator may ask you to use two-factor authentication (2FA). After your password, you enter a short code from your phone or email. This protects your account even if someone learns your password.
Setting up 2FA
You will see the setup screen right after signing in if your administrator requires 2FA or has asked you to set it up (you may see Skip for now if it is not yet required), or when you choose Set up on My Profile.
Pick a method:
Authenticator app – an app on your phone such as Google Authenticator, Microsoft Authenticator, or Authy generates codes. Works without signal or Wi-Fi.
Email code – a code is emailed to you each time you sign in.
Text message – a code is texted to the mobile number you enter. Not every method may be offered; your administrator chooses.
Authenticator app: open the app, choose Add account or Scan QR code, and scan the code on screen. If you cannot scan, type the key shown under the code. Enter the 6-digit code the app shows to finish. Email or text: the screen tells you where the code was sent; enter it, or click Resend if it does not arrive.
Save your backup codes. Ten codes are shown once. Download or print them and keep them somewhere safe. Each code works one time if you cannot get a regular code.
Click Done.
Signing in
Enter your username and password as usual.
Enter the 6-digit code from your app, email, or text. Email and text codes are sent automatically; click Resend if one does not arrive. Codes expire after 10 minutes.
If you have set up more than one method, Try another way lets you pick a different one (for example email instead of the app).
Optionally tick Remember this device for 30 days on a computer you trust. You will not be asked for a code on that browser again for 30 days.
If your session expires while you are working, a sign-in window appears over the page. Enter your password and your code there; you will not lose your place.
If you cannot get a code
Click Use a backup code and enter one of your saved backup codes.
If you have no backup codes, ask your administrator to reset your two-factor authentication. You can then set it up again with a new phone or method.
Managing your settings
On My Profile, the Two-factor authentication line shows whether it is on; click Set up or Manage to open the panel, where you can:
See your methods. The Primary one is asked for first at sign-in.
Add another method – for example add email code as a fallback to your authenticator app.
Make primary / Remove – change which method is asked first, or drop one you no longer use. (If 2FA is required, you cannot remove your last method.)
New backup codes – creates a new set of ten and cancels the old ones.
Forget trusted devices – every browser will ask for a code again. Use this if you signed in on a shared or lost computer.
Turn off – only if your administrator has not made 2FA required.
Actions that change your security ask you to confirm with a code first: enter the code from your authenticator app, or — if you use email or text — a code is sent to you automatically. A backup code also works.
Common problems
My authenticator code is rejected. Your phone's clock is probably off. Turn on automatic date and time in your phone settings and try the next code.
I got a new phone. If you still have the old phone, add the new one as another method in your profile, make it primary, then remove the old one. If not, use a backup code to sign in and then set up the new phone, or ask your administrator to reset your 2FA.
I am not getting the email. Check your spam folder. Confirm the email address in My Profile is correct. Click Resend.
I am asked for a code on a device I asked to remember. The 30 days passed, browser data was cleared, you are in a private window, or an administrator reset your 2FA. Enter a code and tick the box again.
I use a Duo push. Approve the push on your phone as before. Nothing has changed for Duo users.
Related
Two-Factor Authentication (2FA) (for administrators)