MFA - Post-enrollment Maintenance

How to generate backup codes and add additional authorized devices to satisfy the Duo MFA prompt

Instructions

Generate Backup Codes

A backup code is a one-time use code generated as a backup for Multi-Factor Authentication (MFA), allowing access if your regular authentication device is unavailable. It should be stored securely for emergencies. For more information, please visit: How can I obtain MFA backup codes?

1. Visit MFA Manager > Backup Codes,
2. Select “Generate Codes”
3. Authorize by completing Duo prompt.
4. Store Backup codes in a safe place

Add a device

• To add a University provided code generating token, visit How Do I Register a Code Generator token for use with MFA?
• To add a smart device (android / ios), security key (yubico, feitian, titan, etc.), or Touch ID
  1. Arrive at any given Duo Prompt, outside of MFA Manager
     • To prompt Duo, simply visit mycampus.maine.edu, or another University service protected by MFA. If you are not prompted by Duo to authenticate yourself with MFA, you already have an active Duo authentication session, and you will need to prompt from an Incognito / Private Browsing window. 
     • Alternatively, you may visit MFA Manager then select "Test MFA" to call a similar prompt.
  2. Select “Other Options,” then “Manage devices.”
  3. Satisfy the MFA prompt to proceed
  4. Select "Add a device"
  5. Depending on your client, you will be presented with several four options. (See: What devices can I use?)
     • Do not select "Mobile phone." While Duo will flag this option as "Recommended," the University does not require the additional data collected when users select this option, such as the mobile phone number associated with the device.
     • If enrolling a smart device, whether smart phone or tablet, select “Tablet (iPad, Nexus 7, etc.)”  to avoid the unnecessary collection of your mobile phone number.
       • How do I Enroll in Multi-factor Authentication using the Duo Mobile App on my iOS device?
       • How Do I Enroll in Multi-factor Authentication using the Duo Mobile App on my Android device?
     • If enrolling a security key, select “Security Key (YubiKey, Feitian, etc.)”
       • Connect your security key to your device, then select "Continue" to open a popup window which will prompt you to tap your device. If your security key has biometric input, such as a fingerprint sensor, you will need to set that up according to your device's instructions ahead of associating the key with Duo.
     • If enrolling in Touch ID using Chrome on a supported MacOS device, select “Touch ID”
  6. After your device has been added, you will be directed to the "My Settings & Devices" page.
  7. To exit the Duo prompt, scroll down to the bottom and select "Back to login"

Change the Default Device and Device Name

• Arrive at any given Duo Prompt, outside of MFA Manager
  • To prompt Duo, simply visit mycampus.maine.edu, or another University service protected by MFA. If you are not prompted by Duo to authenticate yourself with MFA, you already have an active Duo authentication session, and you will need to prompt from an Incognito / Private Browsing window. 
  • Alternatively, you may visit MFA Manager then select "Test MFA" to call a similar prompt.
• Select “Settings,” then “My Settings & Devices”
  • If you followed "Test MFA" from MFA Manager, you do not need to select "Settings"
• Satisfy the MFA prompt to proceed to the "My Settings & Devices" page
• To change the Device Name for an authorized MFA device,
  • Select "Device Options" next to the device you desire to edit
  • Select "Change Device Name"
  • Enter the desired change, then select "Save"
• To change the Default Device which is presented first when encountering a Duo MFA prompt,
  • Select the device you'd like to use from the dropdown menu next to "Default Device"
  • If you have selected a smart device, another setting will appear, "When I log in," with which you may also choose whether your device will automatically receive a push notification at the MFA prompt. 
    • To enable, select "Automatically send this device a push notification" from the dropdown menu
    • To disable, select "Ask me to choose an authentication method" from the dropdown menu
  • Code Generating tokens may not be selected as a default device. 

Environment

• Duo Multi-factor Authentication