With cyberattacks on the rise, multi-factor authentication is one of the best ways to protect your online accounts, by requiring two (or more) methods to verify your identity when logging in to systems.

These methods can include something you know, like a username and password, with something you have, like a smartphone app, to approve login requests.

After entering your username and password to log in to a Duo-protected application (such as CCA's accounts website), Duo will prompt you to verify the login from a device you've registered.

If you are NOT prompted to enroll in Duo automatically:

• Login to your account at https://accounts.cca.edu
• Click on Manage Password
• Select the Setup Two Factor Authentication option and complete the steps.

Most online services at CCA are accessible through single sign-on (SSO) login. For the purposes of this guide, try accessing a system with a short timeout period, such as Portal.

If you are already authenticated for a system, you may have to log out and log back in again.

If you are NOT prompted to enroll in Duo automatically upon system login :

1. Login to your account at https://accounts.cca.edu
   
2. Click on Manage Password
   
3. Select the Setup Two Factor Authentication option and complete the steps

Select 'Next' to advance through each screen.

Select your desired authentication method from the dropdown menu provided, then click 'Continue' to proceed.

We strongly recommend using Duo Mobile as your primary authentication method.

This guide walks through device registration using Duo Mobile, but you can follow Duo's enrollment guide for instructions on adding other types of devices.

This step is applicable for mobile phones and landlines. If you have a tablet, select the 'I have a tablet' option on this screen.

1. Select your country from the dropdown list
   
   
2. Enter your device phone number
   
   
3. Select 'Continue' to proceed
   
   
4. Review and confirm the entered number on the following screen, selecting 'Yes, it's correct' to proceed

On the next screen you'll be prompted to install the Duo Mobile app.

1. If you need to install Duo Mobile, please do so:
   
   Download Duo Mobile for iOS
   Download Duo Mobile for Android
   
   
2. Once downloaded, open the Duo Mobile application on your device
   
   
3. Back in the Duo enrollment screen, select 'Next' to continue

Follow these steps to scan the activation QR code shown on the Duo enrollment screen:

1. Open the Duo Mobile app on your device
   
   
2. Select '+ Add' (next to Accounts heading)
   
   
3. Select 'Use QR Code'
   
   
4. Hold your device camera up to the QR code, and await confirmation
   
   
5. From your device, rename the account if desired, then select 'Save'
   
   
6. Once your device has been registered, you'll see a confirmation message on the Duo enrollment screen. Select 'Continue' to proceed

Select another device to register from the list of available options.

We strongly recommend that you register more than one device in Duo to prevent you from being locked out of your CCA accounts in the event that one of your registered devices is lost, broken, or otherwise unavailable.

Device setup will follow device-specific steps similar to those outlined above. Please follow Duo's enrollment guide for instructions on adding other types of devices.

If you choose to skip this step, you can always register additional devices later on.

Your device setup is now complete, and you'll be able to log in to SSO-protected systems using Duo. Select 'Log in with Duo' to proceed.

Enter your CCA credentials, then select 'Login'

Once you enter your CCA credentials, you'll be taken to a Duo authentication prompt. By default, Duo will attempt to authenticate you via the last method you used. From here you can:

• Respond to the authentication request
• Select 'Other options' to choose a different authentication method

Upon authenticating your login, you may be prompted to verify ownership of your registered device. This step is to provide additional account security should your registered device be used by more than one person.

Select the appropriate response on this screen to proceed.

Upon doing so, you should be redirected to the desired web system, now authenticated and logged in.

This option is available for mobile devices on which you have the Duo application downloaded and linked to your CCA account (see setup steps above for details).

When using this authentication method, Duo sends a push notification to your registered device, which you can Approve or Deny (from your mobile device).

Once approved, your login attempt should proceed automatically.

When using this authentication method, Duo sends a set of unique, temporary passcodes via SMS to your registered device. Each passcode can only be used once, and generated passcodes are only valid for 14 days.

Enter a valid passcode into the dialog box on the Duo login screen, then select 'Verify' to authenticate your login. Once approved, your login attempt should proceed automatically.

If you need new passcodes, select 'Send a new passcode' first.

Note that CCA incurs a small charge each time these messages are sent, so authenticating your logins by push notification is preferable!

When using this authentication method, Duo places a call to the registered mobile device or landline. To authenticate, answer the call and follow voice prompts to approve or deny the login attempt by selecting the appropriate buttons from your device keypad.

Once approved, your login attempt should proceed automatically.

Note that CCA incurs a small charge for each phone call-based authentication attempt, so authenticating your logins by push notification is preferable!

When using this authentication method, you will need to procure a valid bypass code from the CCA Help Desk in order to authenticate your login.

Note that this is method is meant for account recovery rather than everyday logins, and you may have to verify your identity before receiving a bypass code from the Help Desk.

You can enter a valid bypass code into the dialog box on the Duo login screen, then select 'Verify' to authenticate your login. Once approved, your login attempt should proceed automatically.

You can use an external device–a security key–that when tapped or pressed authenticates your login attempt with Duo.

Note that Duo only supports this authentication method for certain security keys and browsers, and the device you're logging in from must have an available USB port.

When using this authentication method, insert your security key into the device you're logging in from, then tap or press your security key when prompted. Once approved, your login attempt should proceed automatically.

When using this authentication method, you can make use of authentication methods build into your registered device, such as a fingerprint scanner.

Note that this method is not recommended for managing CCA logins, as Touch ID functionality differs from device to device, and not all such authenticators work consistently across web platforms. Please add at least one other authentication method if you choose to use Touch ID.

Please refer to Duo's device enrollment guide for system/device requirements and device-specific Touch ID enrollment steps.

Select 'Login' to proceed.

Select an authentication option from the list shown, then approve the authentication request once you receive it.

This screen will show you all of your currently-registered devices as well, which you can edit and/or remove if needed.

Then follow the device registration steps as prompted (the process should be nearly identical to registering a device for the first time).

Once you're done, you'll be redirected back to the device management page.

If you lose your registered device for authenticating your logins, you may reach out to the Help Desk for assistance.

We recommend that you register a secondary device with Duo, just in case your primary device is lost, stolen, or broken.

If you did not attempt to log in to any CCA system but you have received a Duo login request to your registered device:

1. Deny the login request
   
2. Change your CCA password
   
3. Contact the CCA Help Desk to report the login attempt

One common reason for delayed or missing push notifications is that your device isn't connected to a cellular data or WiFi network.

If using WiFi, make sure that you are fully connected and, if necessary, signed in to the network (if you're on the CCA campus, you may need to register and/or log in in order to connect).

You will be locked out of your CCA account for 1 hour after 4 failed attempts to authenticate a login via Duo.

The lockout time increases to 90 minutes if you fail to authenticate your next login 4 more times. Lockout time increases to one day if you fail to authenticate 4 more times after that.

Upon successfully authenticating a login attempt, you'll be able to access your account, and the lockout times will reset.

If you will be changing your phone or SIM card for travel, we strongly encourage you to use one of the methods listed in this help article to avoid delays getting into your CCA account. For all of these options, you need to complete the steps PRIOR to leaving the country:

Managing Phone Changes in Your Duo Account

If your number remains the same between devices, you'll just need to download the Duo Mobile app on your new device and connect the app to your CCA account once more (see steps 7 and 8 above).

If your new device also has a new number associated with it, you'll need to re-register the device entirely.

If your old phone was your only registered device and you can no longer use it to verify your logins, you'll need to contact the Help Desk for assistance with registering your new phone.

To register your new phone as a secondary device, follow the steps to register additional devices the next time you log in to a CCA system. Verify your identity using your primary registered device, then follow the setup prompts to add your new phone.

For a single browser session, Duo authentication lasts for 48 hours, after which time you'll be prompted to authenticate when logging in to CCA systems.

Note that CCA systems have their own timeout periods as well, which may affect the frequency with which you are prompted to log in.

Due to reported issues with Touch ID, CCA does not recommend using it as your primary authentication method.

Make sure you set up an alternative authentication method if you use Touch ID for Duo logins.