1. Home
2. Security
3. Duo Security Two-Factor Authentication
4. FAQ

Frequently Asked Questions

Attention: Winter 2025 Duo Policy Changes: 
Emory is strengthening its Multi-Factor Authentication (MFA) policy to better protect Emory users, systems and data. So, we are moving from Duo Push option to the Duo Verified Push for all applications as part of this change. Moreover, the “Phone Call” (“Call Me”) option has been retired and is no longer supported. If you used the “Phone Call” option, please use Duo Mobile Verified Push, Text Message, Duo Passcode, or a YubiKey hardware key instead. These changes are being rolled out in phases in November and December for most users and there will be email communications on specifics.  

Setup Process 

What are my authentication options? 

Smart Phone / Smart Tablet with Cellular Service 

• Duo Verified Push: If the Duo Mobile app is installed and setup on your smartphone, you can choose to receive a verified push notification when you log in. The login screen will display a 3-digit code — enter that code into your Duo Mobile app to approve the authentication attempt. You can deny the request and indicate that it was fraudulent if you did not initiate the attempt. 

• Duo Mobile passcodes: If you have the Duo Mobile app installed and setup, you can receive a single pass code by tapping the key in the mobile app. This pass code must be used immediately. This is a good option if you do not have functional Wi-Fi or cellular signal on your phone. 

• Text message Passcodes: You can receive a one-time passcode via a cellular text message. This code will expire in 1 minute, so you will need to use it promptly. You can re-request another pass code if it expires. Please note that the “Text Message” (SMS) method is considered less secure, and Emory will be phased out sometime in 2026 (TBD).  

Smart Tablet (Wi-Fi Only – Does not Require Cellular Service) 

• Duo Verified Push: If the Duo Mobile app is installed and setup on your tablet, you can choose to receive a verified push notification requiring entry of a 3-digit code displayed on your login screen. If you deny it, you can indicate that it was fraudulent if you did not initiate the attempt. 

• Duo Mobile passcodes: If you have the Duo Mobile app installed and setup, you can receive a single pass code by tapping the key in the mobile app. This passcode must be used immediately. This is a good option if you do not have functional Wi-Fi signal on your tablet. 

Basic Cellular Phone 

• Text message Passcodes: You can receive a one-time passcode via a cellular text (or SMS) message. This code will expire in 1 minute, so you will need to use it promptly. You can re-request another pass code if it expires. Please note that the “Text Message” method is considered less secure. Emory will likely be phasing out SMS sometime in 2026 (specific timeframe TBD).  

Can I use hardware keys or tokens? 

If desired, users can choose to use an Emory approved YubiKey hardware key with Duo. However, this method will incur the cost for the YubiKey, and you will need to either work with your management to obtain the YubiKey through your respective departmental procurement processes or cover the cost yourself. Please see the YubiKey Guidance document for Emory approved YubiKey devices. 

Can I set up Duo on more than one device? 

Yes, in fact you are encouraged to do so. When you are doing your initial setup, you may add as many smartphones, tablets, or hardware security keys as you like (up to 100 for each MFA method). After that, when you are logging in, you can choose which device Duo will send the authentication request to (Duo Mobile app, SMS text message, or YubiKey depending on your setup). 
 
For information on adding additional devices, please visit the Emory Duo Self-Service Portal and refer to the instructions there. 

What if I have multiple NetID’s, one for university and one healthcare access? 

We recommend that you enroll the NetID that you primarily use.  We will automatically enroll the other for you and keep your accounts synchronized. Any device you add to one account will get added to the other. However, if you delete a device, you will need to delete it from both accounts by logging into the Duo Self-Service Portal with each account. 

Do I need a smart phone to use Duo Mobile? 

No, Duo Mobile can also be used on many Smart Tablets (like Apple iPads or Android tablets). This option works just like smart phones, and you can easily complete a Verified Push if you have Internet connectivity or lookup a Duo Passcode if the device is offline.  

What if I don't have a cell phone? 

If you do not have a smart phone: 

• Duo Mobile can also be used on many Smart Tablets (like Apple iPads or Android tablets). This option works just like smart phones, and you can easily complete a Verified Push if you have Internet connectivity or lookup a Duo Passcode if the device is offline.  

• Hardware Keys can be used if you don’t have a Smart Phone or Smart Tablet, but cost may be incurred, and there are some limitations. See the above section (“Can I use hardware keys or tokens?”). 

What if I don’t want to install the Duo Mobile app on my smartphone? 

It’s highly recommended that all employees use the Duo application on their personal device of choice (Smart Phone or Tablet) for MFA because this software is free, secure, and well-supported. For Duo Mobile app setup and enrollment information, please refer to:  https://it.emory.edu/security/two_factor/walkthrough.html 

It is important to note that Duo Mobile cannot see your user data like your contacts, it cannot read your text messages, it cannot access your photos (but it can use your camera to scan a QR code if you explicitly allow that permission), it cannot access your files, it cannot erase your device, it cannot see information about other applications on your device. Duo Mobile cannot track your location. In general, the only personal data that Duo Mobile knows about you are the service accounts that you explicitly add to Duo Mobile. However, Duo does not track any personal data about these accounts -- only the name of the service. For more information on the Duo Website, see - Duo Mobile Privacy Information 

If a user does not want to use a personal device for their MFA or any of the other free options provided by Emory, the user will need to get and use a YubiKey hardware token for access. For more information on Emory approved YubiKeys and relate guidance: Emory YubiKey Guidance.docx 

Adding More Devices 

Please visit the Emory Duo Self-Service Portal and refer to the instructions there. 

Using Duo 

Do I have to use Duo every time I login? 

In general, you will only get challenged for Duo authentication if you're off campus, unless you are accessing a particularly sensitive application. Duo prompting varies by application that is being accessed and can change based on sensitivity of the application or user activity. If there is concerning user activity like many failed authentication attempts, you may also be prompted more. 

Is there anything I can do to decrease Duo prompts? 

On your personal or assigned Emory devices, you should indicate that you own the device from which you are logging in, so you are prompted less frequently (but you will still be prompted.) This option requires you to use the same browser and not clear your browser cache. 

There are several common reasons why you may not be prompted on the ownership of your device: 

• If you have configured Duo to automatically send you a verified push or SMS message instead of asking you which one to use 

• If you are connecting via an iPad, iPhone, or Android device 
• If your web browser does not have cookie support enabled. If you are using the F5 stand-alone VPN client, make sure that cookies are enabled in Edge (if you're using Windows) or Safari (if you're using a Mac). 

What if I don't have a data plan on my phone? What if I don't have a connection? 

The Duo smart phone app provides options that work without a data plan, a texting plan, or even a connection, if necessary. The app can generate the required code without needing either a telephone signal or data plan, and it can do so anywhere in the world. If you have a signal and data plan, the app makes two-factor authentication as easy as entering a 3-digit code through Verified Push, but if you don't, you can use the app to generate a six-digit code and enter that instead. 

Can I use a hardware key/token? 

If necessary, users can use a YubiKey (hardware security key). However, this option will incur a cost by your department and will need to be approved. Moreover, there may be some specialized applications (like VPN) that do not support hardware keys or tokens for technical reasons. Therefore, we strongly recommend setting up the Duo Mobile application on a Smart Phone or Smart Tablet. For more information on YubiKeys (approved devices, setup instructions, etc.), please review the YubiKey Guidance document.  

Can I set Duo to automatically use a particular authentication? 

No. Duo will automatically default to the last authentication method used for the application being accessed or the most secure method otherwise. If that's not the correct method, you can click “Other options” in the Duo prompt and select a different method. 

Common Issues 

I have a new device or phone number, and the Duo App stopped working. What do I do? 

New smartphone 

• If you get a new phone, even if the Duo app is restored from a cloud backup, it will lose its association with your account. If the phone number of your new phone is the same, you can still authenticate using the SMS passcode, but the verified push option will not work until re-activated. 

• You can re-activate your new phone by logging into the Emory Duo Self-Service Portal. If your phone number is the same, set the authentication option to SMS passcode. From here, you can select the phone number of your new phone (assuming it’s the same phone number) and select “Reactivate Duo Mobile”. This will prompt you to scan a new QR code from the Duo app. 

• If you have a new phone number or if you have difficulties with this process, you should contact your Emory Service Desk. Users with a new phone number will receive a temporary passcode with which they can use at the “Add a new device” option to then go through the above process.  

• The University Service Desk may be reached at 404-727-7777. Emory Healthcare Service Desk, 8-Help, may be reached at 404-778-4357. 

New basic cell phone 

• If your phone number has not changed, no action is needed. 

• Otherwise, contact your Emory Service Desk to receive a temporary passcode which you will use at the Emory Duo Self-Service Portal. Choose “Manage Duo”, log in with your Emory NetID and password, then use the passcode to authenticate. Then select the “Add a New Device” option. From here, you can go through the process of adding your new phone.  

• If needed, the University Service Desk may be reached at 404-727-7777. Emory Healthcare Service Desk (8-Help) may be reached at 404-778-4357. 

New tablet 

• If you get a new tablet, even if the Duo app is restored from a cloud backup, it will lose its association with your account. You can activate your new tablet by logging into the Emory Duo Self-Service Portal. If you have an alternative way to authenticate with Duo, you can use that to authenticate. Otherwise, you should contact your Emory Service Desk to receive a temporary passcode with which you can use to authenticate. Then choose the “Add a new device” option and follow the on-screen instructions. 

• If needed, the University Service Desk may be reached at 404-727-7777. Emory Healthcare Service Desk, 8-Help, may be reached at 404-778-4357. 

What if I don't have my phone? 

You can contact the Emory Service Desk. They will verify your identity and provide a temporary passcode. You may be able to use an alternative phone number with SMS, if you have set that up. The University Service Desk may be reached at 404-727-7777. Emory Healthcare Service Desk, 8-Help, may be reached at 404-778-4357. 

What if I lose my phone? 

Please contact the University Service Desk (404-727-7777) or the Emory Healthcare Service Desk (404-778-4357) to have them immediately lock your Duo account. They will set you up with an alternative method to authenticate. 

Sometimes my phone doesn't receive a push notification like it should. What can I do? 

 Verified Push notifications can occasionally be delayed if your device switches between networks or has weak signal. You can manually refresh by opening the Duo Mobile app and pulling down to sync pending verification requests. 

You may also choose an alternate authentication method such as Duo Mobile Passcode or Text Message (SMS) passcode options. 

Also, be sure that you have allowed the Duo app to send you push notifications. This must be enabled for you to receive a verified push notification without manually checking the app. 

Why am I not getting the option to indicate I own the device within Duo? 

There are several common reasons why you may not be able to select the option that you own the device. 

• If you are connecting via an iPad, iPhone, or Android device. 

• You are not using a web browser to access the application, or your web browser does not have cookie support enabled. If you are using the F5 stand-alone VPN client, make sure that cookies are enabled in Edge (if you're using Windows) or Safari (if you're using a Mac). 

• Some sites that require higher security, such as the PeopleSoft/eVantage direct deposit page, will not allow trusted devices to be used. 

How to enable cookies in your browser: 

Edge: 

• Click … -> Settings -> Privacy, search, and services -> Cookies  

• Toggle the Allow sites to save and read cookie data (recommended) to on. 

Firefox: 

• Click on the Menu button -> Settings -> Privacy & Security 

• Set Browser Privacy -> Enhanced Tracking Protection to Standard 

Safari: 

• Go to the Home screen by pressing the Home button 

• Select the Settings icon 

• Select Safari from the Settings menu 

• Select Accept Cookies from the Safari menu 

Chrome: 

• Type the following into the Chrome URL bar to open cookie settings: chrome://settings/content 

• Under Third-party cookies, choose "Allow third-party cookies" 

Why does a phone or other device re-appear in my account after I delete it? 

If you have both a University and Healthcare NetID, you likely need to delete the device from both accounts. For people with two Duo accounts, we automatically sync the configuration between them so that if you want to add a device, you only must do it once. Unfortunately, syncing the accounts like this also means that if you delete a device from only one, it will automatically copy back in from the other. If you need help making sure you delete a device from both accounts, please contact your Service Desk (University Service Desk at 404-727-7777 or Healthcare Service Desk/8-HELP at 404-778-4357) 

My phone never receives push notifications. What can I do? 

Ensure that you have allowed the Duo app to send you push notifications. This must be enabled for you to receive a push notification without manually checking the app. 
 
Android Users: Go to settings > apps > Duo Mobile > Notifications and make sure "Allow Peeking" is set to on, and "Block all" is set to off. (These instructions may vary if you are using a version of Android older than 6.0) 
 
iPhone Users: Go to settings > notifications > Duo Mobile and make sure "Allow Notifications" is set to on. 

If you are on the new Duo Verified Push version, ensure you are entering the 3-digit code displayed on the login screen into the Duo app. 

I'm often in a location where I have poor cell coverage; how can I use the service? 

In cases where cell coverage is not available, you can also use the Duo Mobile passcode option. Just choose “Other Options” and then select the “Duo Mobile passcode” option as pictured below: 

Then you will be prompted with for a passcode (as pictured below): 

Then use your smart phone or smart tablet with your Duo Mobile application to look up the current passcode. Look for the “Passcode ••••••” and click on the “Show” button to display the current code. Then type that code into the screen above and click “Verify” to complete the authentication.  

I'm getting an error message that says, "There was an error completing this request. If this problem persists, please contact your administrator. " What do I do? 

This error sometimes occurs after upgrading your phone. In any event, you should contact your Service Desk (University Service Desk at 404-727-7777 or Healthcare Service Desk/8-HELP at 404-778-4357) and ask them to re-issue your Duo Mobile activation code, referencing this problem.  

I'm receiving Push Notifications/Phone Calls/Text Messages from Duo even though I haven't logged into any applications 

If you are receiving requests from Duo to approve a login that you did not initiate immediately prior to getting the notification from Duo, it's very likely that someone has your password and is attempting to login with your credentials. If this happens you should deny the request(s) and change your password immediately by calling the University (404-727-7777) or Healthcare (404-778-4357) service desks, or by visiting the Knowledge base article. 

About Duo 

Can I use Duo internationally? 

If you travel internationally, don’t worry – Duo authentication can work without cellular service or a Wi-Fi connection. You have several options that may be useful: 

1. Smartphone – Even with cellular service disabled or without a Wi-Fi connection, you may use the Duo Mobile app to generate a Duo Mobile passcode (option pictured below) that you can use to authentication.  

Simply choose the Enter a Passcode option when you get the Duo authentication prompt. To generate the passcode, open the Duo Mobile app on your phone and tap the down arrow symbol ∨ next to "Emory".   You can also use Duo Verified Push: When online, you will receive a verified push notification requiring you to enter a 3-digit code displayed on the login screen. This method works anywhere you have internet connectivity. 

1. Hardware Key / Token – If you don’t have a smartphone and you travel internationally often; you may want to purchase a YubiKey (hardware-backed FIDO2 passkey) through your department. Contact the Service Desk (University Service Desk at 404-727-7777 or Healthcare Service Desk/8-HELP at 404-778-4357) to start the process.  

1. Bypass Code – If you won’t have a smartphone and a hardware token is not an option; it is possible to get a bypass code that you can use for Duo authentication for the duration of your trip.  Contact the Service Desk (University Service Desk at 404-727-7777 or Healthcare Service Desk/8-HELP at 404-778-4357) to request this option.  Then, simply choose the Enter a Passcode option when you get the Duo authentication prompt and enter the bypass code that you were given. 

1. Normal options – If you have cellular service or a Wi-Fi connection, then you can simply use whatever authentication technique you normally use.  Verified Push and passcode options work internationally; Phone Call authentication has been retired.  You can even add an international phone number that can receive SMS messages as one of your authentication options. 

If you have questions about any of these authentication options, please consult the Duo FAQ page or the Duo User Guide. 

What data is stored by Duo? 

The only data that Duo stores for a user is the subscriber's Emory’s NetID, email address, and information about your second factor, such as a phone number (if using a phone for the service) or the serial number of your hardware token (if not using a phone for the service). Duo does NOT know your Emory password.  

I like to protect my personal device data. What data can Duo see and what can Duo do?

It is important to note that Duo Mobile cannot see your user data like your contacts, it cannot read your text messages, it cannot access your photos (but it can use your camera to scan a QR code if you explicitly allow that permission), it cannot access your files, it cannot erase your device, it cannot see information about other applications on your device. Duo Mobile cannot track your location. In general, the only personal data that Duo Mobile knows about you are the Duo service accounts (like the one for Emory) that you explicitly add to Duo Mobile. However, Duo does not track any personal data about these accounts -- only the name of the service. There is more information on the Duo Website - Duo Mobile Privacy Information

Does it cost me anything to use Duo via my phone or smart tablet? If so, will I be reimbursed by Emory?

There is no cost to download or use the Duo Mobile application. If you incur volume-based data charges today for text or network data services on your phone or smart tablet, use of Duo Verified Push or Text message passcode may incur charges. Such charges are considered personal charges, and Emory will not reimburse such charges. However, in general the data charges for most Duo users fall within their base cellular service plans without additional costs incurred. Nevertheless, if you do not wish to incur charges on your smart phone or tablet, it’s best to use the Duo Mobile passcode option (pictured below) since it doesn’t use any network data once it’s downloaded.

Likewise, the Text message passcode option may incur Text/SMS message or data fees. Therefore, if you have a Smart Phone and want to avoid such fees, we will also recommend using the Duo Mobile passcode option over the Duo Verified Push or Text Message Passcode options that might incur costs.  

Can I opt-out of using Duo? 

No. Enrolling in Duo helps protect your Emory accounts from compromise even if you never expect to use it. Consequently, for the increased protection of your own personal information, the information of our faculty, staff, students, and patients, as well as other Emory Information & Systems, everyone with an Emory NetID must enroll in Duo Security. 

Where can I get more information? 

Emory’s Website on Duo MFA: https://it.emory.edu/security/two_factor/index.html 

Duo Vendor Guide with Additional Details: https://guide.duosecurity.com 

If this FAQ and the other references listed above don’t address your need, you can also Call the Service Desk:  

• The University Service Desk may be reached at 404-727-7777.  

• Emory Healthcare Service Desk, 8-Help, may be reached at 404-778-4357.