Duo Help Guides - Technology at SCU - Santa Clara University

First-time Enrollment in Duo

This section is for first-time enrollment in Duo. If you have already enrolled in Duo, see the Add Or Manage Devices After First-time Enrollment section to add or update your enrolled devices.

Select your enrollment options

Review the Duo options shown in the section above, Deciding Which Duo Options To Use. Select a primary option (Duo Mobile Push is recommended), and select a backup option that works for you (like a Duo Mobile on a tablet, or a phone call to a landline).

To get started with the Duo Mobile App...

The Duo Setup Quickstart will get you started with the Duo Mobile app.

Don’t have a smartphone, or don’t want to use the Duo Mobile App?

If you don't have a smartphone, or if you don't want to use the Duo Mobile app, follow the detailed instructions in the Duo guide to set up other options:

Step 1: Introduction

Go to the MySCU Login portal. Click on a tile for a Duo-protected application (such as Google Workspace), and you will be prompted to set up your Duo account.

Step 2: Choose Your Verification Method

The verification methods are shown in the Duo guide, with the most secure options at the top of this list.

Step 3: Add Your Chosen Method

Once you choose the method to verify your identity, follow the step-by-step instructions in the Duo guide to add that method.

Step 4: Add a Backup Method

Add a second verification method that you can use as a backup if the first method you added isn’t available, like if you lose or forget your phone and need to log in with Duo, or if you want to access an application from a different MacBook than the one you used to set up Touch ID in Duo.

Once you’ve added a backup method, you’re at the end of the Duo setup process. Click Log in with Duo to log in to the application using the Duo method you just added.

Duo Universal Prompt Login Options

Duo 2FA at SCU supports the following methods:

Touch ID
Security Key
Duo Mobile Push
Hardware Token Passcode
Text Message (SMS) Passcode (for some users)
Phone Call (for some users)

The way each 2FA option works is described below, from the most secure (Touch ID) to the least secure (Phone Call).

Touch ID: Touch your Mac's Touch ID sensor when prompted to log in to the application. To use Touch ID with Duo, you must have:

a MacBook Pro, MacBook Air, or Magic Keyboard with a Touch ID button
a fingerprint enrolled in Touch ID (see Apple’s documentation for how to do this)
Chrome 70 or later

Security Key: Plug a Security Key into a USB port, then tap or press it to verify your login. To use a security key with Duo, you must have:

a supported browser
an available USB port
a Security Key

When you first register a Security Key, you may see a browser-specific dialog screen asking you to share the security key's make and model with Duo. You should accept/confirm this dialog before you can proceed with registration. No personal information is shared with Duo when this is done.

Need a Security Key? Employees can request a Security Key by contacting the Technology Help Desk.

Duo Mobile Push: Receive a login request on your smartphone or tablet with Duo Mobile installed. Review the request and tap Approve to log in to the application. The Duo Setup Quickstart gets you started with the Duo Mobile app.

Hardware Token Passcode: If you have a hardware token that generates a passcode, enter that passcode into the Duo Prompt, then click or tap Verify to log in.

Need a Hardware Token? Employees can contact Information Services at 408-554-4581 to request one.

Text Message (SMS) Passcode: Log in using a passcode received from Duo in a text message. The Duo Prompt will show that a text message was just sent to you with a passcode. When you receive the message, enter that passcode into the Duo Prompt, then click or tap Verify to log in.

Phone Call: Answer the phone call from Duo and follow the voice instructions to log in.

Note: This is the least-secure option, and it is significantly more expensive than any other verification method. Because of the cost incurred to the university, using a Phone Call should only be considered as an option of last resort.

Deciding Which Duo Options To Use

In most cases, Duo Mobile Push is the best way to authenticate -- it’s quick and it’s secure. Read more from Duo

Option	Network Connection	Advantages	Disadvantages
TouchID	WiFi or wired connection	Most secure option Can use in any location, even when traveling if you plan on bringing your Apple laptop with you Very quiet / non-disruptive	Tied to a specific devices that supports TouchID (Macbook Pro or Macbook Air) Tied to a specific browser (Chrome) Does not work as a 2FA method for SCU VPN
Security Key	No network required	FIDO technology; Phish resistant Use in any location Can use while traveling Very quiet / non-disruptive	Tied to specific browsers Small device is easier to forget than a mobile phone Requires an accessible USB port each time you need to authenticate using Duo Does not work as a 2FA method for SCU VPN
Duo Mobile Push	Cellular or WiFi	Works with any browser Works in any location Works with your Apple Watch With the Duo Mobile Passcode option, use when traveling or out of cellular service Works as a 2FA method for SCU VPN	None
Hardware Token Passcode	No network required	Works in any location Can use when traveling Very quiet / non-disruptive Works as a 2FA method for SCU VPN	Small device is easier to forget than a mobile phone
Text Message (SMS) Passcode	Cellular or WiFi	Use with any browser Use in any location Works as a 2FA method for SCU VPN	Less secure Text message rates apply to employee or student Incurs a higher cost to Santa Clara University Text message notification sound might be disruptive in some environments Not available to all SCU users
Phone Call	Mobile phone - cellular service Landline - telephone service	Use with any browser	Least secure Incurs the highest cost to Santa Clara University If landline, tied to a specific location Can't use method when traveling (landline) or without service (mobile phone) Ring volume might be disruptive in some environments Does not work as a 2FA method for SCU VPN Not available to all SCU users

Don’t have a smartphone?

The most convenient and easy way to authenticate is by tapping the notification that pops up in the Duo Mobile smartphone app. However, the app is currently only available for Apple and Android smartphones. If you have a different type of phone, you will not be able to take advantage of the Duo Mobile app.

There are several options available for people in this situation, including TouchID, or a Duo Security Key. Please contact the Technology Help Desk for assistance.

Requesting a Bypass Code

In the event that you've lost or left your phone or hardware token at home, you may have no way of authenticating to Duo.

You can get a single use, temporary bypass code from either the Technology Help Desk or by using the Bypass Code Generator. You must have previously set up alternative (non-SCU) contact information to use the Bypass Code Generator.

Once you have your code, click or tap on Other options, then select I have a bypass code in the Duo prompt. Type in the bypass code, then click or tap Verify to log in.