Duo Multi-Factor Authentication for SSO FAQ

SSO stands for Single Sign-On. You know you’re logging in using the Pima College SSO platform when you see the screen shown here.

After you enter your username and password and click Login, the system then prompts you to verify your identity using the Duo app.
To see the Duo MFA login process, watch this short video.

Multi-factor authentication adds a second layer of security that helps faculty and staff protect themselves and the College against cybercrime. MFA uses multiple factors—something you know, such as your user ID and password, and something you have, such as your smartphone—to increase your account’s security. MFA prevents others who know your password from logging in to your account, because only you have your phone—the additional factor.

You’ve probably already used MFA verification with your bank, personal email, or online shopping accounts. One popular form of MFA requires, after you log in with your password, that you enter a code sent to you via text message or email.

Learn more about MFA and get details from the US Cybersecurity Agency [External Link].

Pima has adopted a more secure multi-factor authentication system, Duo MFA. With this system, when you use a browser to log into a College system with your username and password, you’ll see the Enter code in Duo Mobile message box. You provide the additional verification using the Duo Mobile app on your smartphone or tablet. You can watch the process in this short video.

Yes, there is an extra step, so your login process takes a moment or two longer.

That depends. The MFA timeout is 20 hours, so you can expect to use Duo Mobile once a day when logging in via SSO. If you answer Yes when the login process asks Is this your device?, you should be able to close the browser within that 20-hour period, then reopen it on the same device and log in without taking the additional Duo step. However, if you log in with a different device or using a different browser, you must use MFA again.

Yes. Because it is your second factor, you must have your smartphone with you when you log in.

If you forget your phone or misplace it, you cannot log in until you have contacted the Service Desk and worked with them.

There are three reasons for the College to use this system:

• Because the College disburses federal student aid, we must comply with a federal law called the Gramm-Leach-Bliley Act. GLBA requires the College to use certain information privacy protections and safeguards. MFA is one of those safeguards.
• The College carries an insurance policy that assists us against cybersecurity threats. To remain in force, that policy requires the College to use an MFA system.
• Cybersecurity experts consider MFA a best practice for computer network security. The College must use MFA to protect the institution and ensure the confidentiality, security, and integrity of information about faculty, staff, students, and parents.

Faculty, staff, and student workers who have active accounts must use Duo MFA to access non-public College web pages or applications. In addition, people and companies with College contracts that require access to College computer systems must use Duo MFA.

Yes, the College will use Duo MFA for the foreseeable future.

Yes, all faculty, staff, and student workers must use Duo MFA.

Yes. Using the Duo Mobile smartphone app is the recommended method for responding to a request for verification. Therefore, you will need your phone with you when you log in. Employees must install and use the Duo mobile app if they use a college-provided smartphone or tablet, or if they are receiving stipends for using their personal smartphone.

Yes, the Duo Mobile app is free for anyone to download and install. You should know that authentication uses a small amount of data (a few kilobytes per login).

Your smartphone, whether it is an iPhone or an Android device, can use the Duo Mobile app. You can also use the app on an iPad or Android tablet as long as it has a Wi-Fi or cellular data connection.

If you don’t have a smartphone or tablet, your second factor can be a hardware token, also called a fob. Other, less secure options include receiving a text message or a phone call on your basic cell phone or a call on a landline phone. You should discuss these options with your supervisor, who must approve your use of one of these alternatives. When you have your supervisor’s approval, create a service request to ask that the Information Technology (IT) department either issue you a fob or add you to the list of people authorized to use text message or phone call as a second factor.

• In general, the hardware token (fob) is more troublesome to use than the Duo Mobile app: when you log in and see the request for verification, you have only a few moments to find the token, push its button to generate a new passcode, and then enter the digits correctly.
• A main drawback is that tokens get out of sync: if the button is pressed too many times in a row and the generated passcodes aren’t used for login, the token loses its synchronization with the Duo server. If the token is out of sync, you can’t log in. When that happens, you must contact the service desk and work with them.
• Tokens are easy to lose because they are small and used only once a day (unlike your smartphone). Many people solve that problem by adding the token to a keychain or keeping it in a purse or backpack, where it is easy for other items to press the button, leading the token to get out of sync.
• Young children love to press a button and watch the numbers change, repeatedly. But their fun causes the token to get out of sync.

Duo Mobile actually enhances your online privacy and the security of College computer systems; it significantly improves the protection of your account data from cybercriminals. The only data of yours available to IT's Duo Administrators is:

• The type of device you use
• The software version of your device
• Your phone number, if you provide it when you enroll yourself in Duo MFA.

Duo Administrators use that data only for purposes of administering the Duo service. The Duo Mobile app on your phone does not share any other information with the College. Duo’s knowledge base [External Link] provides more information regarding the privacy of the Duo Mobile app.

While using the app on your personal phone is optional, we highly recommend it. Duo Mobile is the most secure—and fastest—way to authenticate during login.

Using the app to validate a code is more secure than a text message. If you have a smartphone, you should download, install, and use the Duo app.

You must self-enroll. See the Duo MFA Enrollment Quick Start Guide knowledge base article for a step-by-step description of the self-enrollment procedure.

When traveling outside the United States, you may have an internet connection on your laptop but not have a cell signal on your basic cellphone or smartphone. In this situation, you have two options:

• The Duo Mobile app on your smartphone, which you can use even without cell service
• A hardware token (fob).

If you have a fob, use it as you normally would.

If you have a smartphone but no cell signal, the easiest option is to use the Duo Mobile app you have already installed and enrolled. You can use the Duo Mobile app to generate a passcode, just like the fob does, as described below.

1. When the login page prompts you to enter the three-digit verification code, select Other options, and then, in the list of options, select Duo Mobile Passcode.

2. Open the Duo Mobile app on your phone, which displays a six-digit passcode.

3. On your laptop, at the Enter your passcode page, enter the six-digit passcode from the Duo Mobile app, and then select Verify.

Duo Mobile app passcodes are valid until they are used or refreshed.

A bypass code is a one-time code used to log in to Duo. IT provides these on a case-by-case basis.