Multi-Factor Authentication FAQs

Multi-factor authentication (MFA) means using at least 2 factors to authenticate your identity, consisting of:

1. Something you know: Your username and password
2. Something you have: Your smartphone with the DUO Mobile Application or a hardware token.

A common example of MFA is when you login to your bank account with a username and password, and the bank sends a text message with a verification code to confirm your login.  In this example, the first “factor” of authentication is your username and password (something you know), and the second “factor” is the verification code contained in the text message sent to the preregistered phone number (something you have).

MFA adds an extra layer of security to protect your SRSU online accounts against cyber criminals, and helps to protect all SRSU students, faculty, and employees from hacking, phishing, unauthorized intrusions and data leaks. Multifactor authentication is becoming a standard in online account protection as more and more data breeches leak account information. Microsoft, Google, Apple, and other services all have created or adopted their own MFA methods. In short, username and password alone are no longer sufficient for protecting sensitive data, the university must add another layer of security to SRSU accounts.

SRSU has chosen the DUO Mobile Application as our Multifactor Authentication system.

Duo is required for all SRSU students, faculty and staff.

You can set up Duo from your phone. You can scan a QR code or you can contact the HelpDesk and they can walk you through the process. More information, and screenshots, is available on our activation tutorial page. (coming soon)

No.  Registering for MFA does not give SRSU access to your device. The DUO Mobile Application serves only to provide multifactor authentication. It does not access any personal information on your device, nor does it track your location. Learn more about Duo’s commitment to privacy on their website.

Yes! Visit the app store on your smartphone to download Duo Mobile. Please note that Google Play Services are required to receive push notifications on Android. Users without Google Play Services installed will have to “fetch” by swiping down in the Duo Mobile app.

• Duo Verified Push – if you have the Duo Mobile App installed on your smartphone, you can receive a push notification. From the app, you can enter the code and approve the login attempt or deny the login attempt.
• Hardware Token – you purchase a USB hardware token from the university that will allow you to use DUO MFA without a smartphone.

Verified Push is a more secure version of the Duo Mobile Application that requires users to enter a numeric code from the authentication prompt on their mobile device. When Duo detects a login, it will display a code on the screen the person is using to log in. You will simultaneously get a request to answer the code in your Duo app. Entering the code on the app verifies you are the person logging-in.

For accessibility exceptions to Duo Verified Push, please submit a ticket to LTAC@sulross.edu

OIT understands that there may be moments when users encounter accessibility challenges that impede their ability to utilize multifactor authentication methods effectively. If you require an accessibility exception to Duo, we encourage you to reach out to us as soon as you can by submitting a ticket detailing your needs to LTAC@sulross.edu. Our dedicated security team will review your request and work to provide a suitable solution tailored to your requirements.

If you’re using the Outlook mobile app, Outlook desktop app, Office365 apps, or the mySRSU portal in general, you will be required to authenticate once every 21 days. More frequent authentication will be required if you do not choose the “Yes, this is my device” option or switch devices regularly.

If you access Microsoft 365 applications using a web browser (www.office.com) you’ll be required to authenticate once every 21 days. More frequent authentication will be required if you do not choose the “Yes, this is my device” option or switch browsers regularly.

You will not need to authenticate with DUO if you are logging-in to one of those applications from a computer on the main campus network.

Select the “I’m Not Logging In” button to deny access to your account, then promptly change your mySRSU password. Contact the OIT Help Desk for assistance.

If you replace your device that has the DUO mobile application installed but keep the same phone number, you will need to follow the instructions here (link coming soon) or contact the ITS Help Desk so we can remove the registration from the old device and allow you to register the new device.

If you lose your device, or you are using a new phone number, contact the OIT Help Desk so we can remove the old phone number and register the new phone number. The OIT Help Desk will verify your identity prior to making the change.

Please report a stolen or lost device to the OIT Help Desk as soon as possible so we can prevent it being used to fraudulently verify a login to your account.

You have several choices when traveling abroad. Be sure to test them out before you leave so you can determine which solution is best for you.

• If you do not have your two-factor authentication device with you, please contact the OIT Help Desk to obtain a temporary access code. These expire after 72 hours, so be sure to use one of these passcodes to register a multi-factor device you can use abroad.
• If you do have your phone with the DUO Mobile Application, the Duo Mobile Application can generate a six-digit passcode even if your phone does not have cellular, network or Wi-Fi service. Launch the Duo Mobile Application and press the key icon to obtain a passcode.
• If you only have a basic cell phone, you may purchase a hardware token from the OIT Help Desk.

Faculty, staff, and students are required to use MFA when accessing certain SRSU online resources. At this time, MFA is required for the following applications*:

• mySRSU portal
• Microsoft M365 web-based applications, which includes:
  • Outlook Email (Exchange Online) at https://www.office.com
  • Outlook app for mobile devices
  • Microsoft Teams
  • OneDrive
  • OneNote
• Microsoft Office365 desktop applications
  • Outlook desktop
  • Word desktop
  • Excel desktop
  • PowerPoint desktop
• Any online services that use single sign-on (i.e. Your SRSU Username/Password).

*Using the “Yes, this is my device” option will reduce the frequency of DUO push notifications when logging in.

You can contact the OIT Help Desk if you need help managing your DUO mobile application or MFA enrollment.  We can help you with your initial DUO MFA enrollment or re-enroll you into DUO MFA with your new device.