Multi-factor authentication (MFA) requires something you know (your UMID password) and something you have (like a smartphone or tablet app, or a mobile phone or landline phone) as an added layer of security to prevent anyone else from accessing your account. Multi-factor authentication is one of the most effective methods to prevent phishing, helping to protect you and the UMB community. Duo is the multi-factor authentication solution at UMB.

Passwords are essential for security and privacy, but they are often not enough. They can often be stolen, guessed, and hacked — you might not even know who else has your password and is accessing your account. Multi-factor authentication adds a second layer of security to your account to make sure that it stays safe, even if someone else knows your password, by using your phone or other device to verify your identity. You will be alerted right away (on your phone — mobile or landline — or tablet) if someone tries to log in using your password. This prevents anyone but you from accessing your accounts.

• All faculty, staff, and students are required to use Duo to access MFA-protected applications. 
• Affiliates who are highly-privileged users of eUMB, SIMS/Banner, and ImageNow are required to use Duo. 
• All VPN groups are required to use Duo to login to the VPN.
• All users who access https://portal.office.com from off-campus are required to use Duo.

The Duo Mobile app is required. You can find details about the Duo enrollment process here: www.umaryland.edu/cits/services/duo/enrollment/.

It is very important to enroll more than one device to avoid problems if you lose your primary device, you do not have it with you, the battery dies or for some reason your primary device is not available. 

To add a backup device, follow the procedures listed here: https://www.umaryland.edu/cits/services/duo/existing-user---duo-universal-prompt/

You can use a landline or a tablet. Duo also lets you link multiple devices to your account, so you can use your mobile phone, a landline, and/or a tablet. We suggest that you enroll more than one device for redundancy in the event that a device is lost or unavailable.

If none of these options is available to you, you can be issued a hardware token, or "fob." Please contact Central Administration - IT Help Desk 

If your account has been enabled to use Duo as the second factor, you will log in to the system as you usually do.  You will then be prompted to enter the second factor. Duo Push is the default option. 

Duo Push

A "Duo Push" is a login request to your iOS or Android phone or tablet if you have Duo Mobile installed and activated. Review the request on your phone or tablet and tap Approve to log in to the application.

Click "other options" to use alternative options. 

Duo Mobile Passcode

Log in using a passcode generated by the Duo Mobile app installed and activated on your Android or iOS device. Open Duo Mobile and tap it to generate a six-digit passcode. Enter that passcode into the space provided and click or tap Verify to log in to the application

Text Message Passcode

Log in using a passcode received from Duo in a text message. When you land on the text message page, it will show that a text message was just sent to you with a passcode. When you receive the message, enter that passcode into the space provided and click or tap Verify to log in to the application.

If you did not receive the text message from Duo, use the Send a new passcode link to try sending it again.

Passcodes received in a text message expire when used.

Phone Call

Authenticate via phone call back. Answer the phone call from Duo and follow the voice instructions to log in to the application.

Bypass Code

Log in using a code provided by the help desk. Enter that code into the space provided and click or tap Verify to log in to the application.

The first time you approve the Duo authentication request, you'll see the option to remember your device.

Choose Yes, this is my device to create a trusted device session that will let you skip Duo two-factor authentication when you log in again with the same browser and device until that remembered device session expires in 7 days.

When your trusted browser session expires, you will need to use two-factor authentication again. Duo Push, phone call, text message, and passcode authentication methods will show the option to remember the device already enabled for you. Leaving the option enabled creates a new remembered device session.

If you don't want to remember the device anymore, uncheck the Remember me box before you approve the Duo Push or phone call request or enter a passcode.

This checkbox is based on a cookie; if you check the box, it will remain until the cookies are cleared on that browser. Once the cookies are cleared, the checkbox is cleared and you will need to authenticate with Duo again.

Yes, you can still use Duo without the mobile app. The Duo Mobile app is the preferred second factor to use with Duo.  It is the easiest method and will provide the best user experience. However, if you do not have a smart phone, or your smart phone is broken, or not available, or you have not installed the Duo Mobile app, you can still use Duo.

If you cannot use the Duo Mobile app on your smart phone or tablet now - because your phone is broken, the battery is dead, the phone is not with you, the app was uninstalled, etc. the ability to generate a bypass code is available.

• From any browser, use this link. 
• In the UMID field, enter your UMID.
• On the next screen, enter your password.
• Click Submit
• The UMB Account Management page will appear. In the Setup your: menu to the left, select Multi Factor Authentication (Duo).
• The Duo Self Service page will appear:
• Click Generate Bypass Code.
• You will be asked to identify yourself by entering your date of birth and either the last 4 digits of your SSN or a UMB PIN.
• Click Submit.
• The Duo bypass code will appear. It will be valid for 10 minutes. Either write the code down or highlight the code by selecting Ctrl + C to copy it.

To use the code:

• When signing into an application requiring MFA, on the Choose an authentication method screen, click Enter a Passcode.
• Enter the provided passcode and then click Log In.

NOTE:  Generating a bypass code is meant to be typically a temporary solution. If you need a permanent solution because you do not have a smartphone or it is not

If you cannot use the Duo Mobile app on your smart phone or tablet now or in the future - because you do not have a smart phone or cannot install the Duo Mobile app for some other reason, etc. - please call the Help Desk, at 706-4357.

We can issue you a temporary passcode so you can access your account and add another device, like a landline, or temporary mobile phone.

We can help you to setup one or more landlines so Duo can call your desk phone, home phone, mobile phone, etc.

We can also help you to determine whether a hardware token or "key fob" is a possible solution for you.

You can use a landline or a tablet. Duo also lets you link multiple devices to your account, so you can use your mobile phone, a landline, and/or a tablet. We suggest that you enroll more than one device for redundancy in the event that a device is lost or unavailable.

If none of these options is available to you, you can be issued a hardware token, or "fob." Please coordinate with your local school or department IT team for approval.

Contact the Help Desk via email or call 410-706-4357 immediately if you lose your phone or suspect that it has been stolen. The device will be disabled for authentication and you will be assisted in enrolling another phone/device.

While it is important that you contact the Help Desk if you lose your phone, remember that your password will still protect your account.

It is important to enroll more than one device (such as a smartphone and desk phone) in MFA to avoid difficulties authenticating if you lose or don’t have your only enrolled device with you.

To add a backup device, follow the procedures listed  here.

We recommend that you have two devices registered with Duo in case one device is unavailable. In the event that you can't access your account due to your device(s) being unavailable, please contact the IT Help Desk via email or at 410-706-4357 for a temporary bypass code to allow access to your accounts.  You can also request a temporary bypass code.  See the instructions above under "Temporary".

You will have six chances to authenticate a request. After the sixth chance, your multi-factor account will be locked and you will not be able to access the system you are attempting to log into.

Your multi-factor account will automatically unlock after 10 minutes. If you continue to have issues, you will need to contact the Help Desk via email or 410-706-4357 for assistance with your account.

Deny the request and report the incident to the Help Desk immediately via email or by calling 410-706-4357.