Multi-Factor Authentication (MFA), Troubleshooting

This article can help with common issues users may encounter when trying to use multi-factor authentication (MFA).

Requesting a Temporary Passcode

If you lose, misplace, or forget your MFA device and cannot authenticate, you can request a temporary passcode. These can also be requested if you are going to a testing center and will not have access to your device.

Passcodes are good for 3 days or 100 uses, whichever comes first. You can request 24 passcodes per year, so these should not be relied upon as a primary authentication method.

The instructions below assume that you know your password. If you do not know your password, please contact your help desk.

You need to request a Passcode in advance (i.e. you currently have your device)

Visit the NetID Center.
Select Temporary Passcode at the bottom of the page.
Click "Yes, I have my device".
Authenticate like normal using the device.
Your passcode will then be displayed along with the expiration date.

You do not have your device and need a Passcode now

Visit the NetID Center.
Select Temporary passcode at the bottom of the page.
Click "No, I don't have my device".
Authenticate using your password.
An email with a passcode will be sent to your password recovery email. The email will be from noreply@uillinois.edu and subject will be UI Verify Temporary Passcode.

If you do not have recovery options set up or cannot access your recovery options, you will need to call your University Service Desk to get a temporary passcode.
Once you receive a temporary passcode, please visit https://identity.uillinois.edu to set up your recovery email under the Recovery Settings.
For instructions on setting up recovery options, see NetID Center, Set and modify your recovery options.

Using a temporary Passcode

Duo Universal Prompt (Microsoft365 (Outlook, Word, Excel, etc.), Shibboleth (Canvas, Box, Zoom, Moodle, etc.), or the NetID Center):

Go to the application you are trying to access that requires MFA and login with your NetID and password.
Select the Bypass code option.
Enter the code and click Verify.

Screenshot highlighting the bypass code option at the Duo Universal Prompt

AITS Duo Prompt (some AITS Applications such as Banner, HR Reporting, My UI Info, Direct Deposit, etc.):

Go to the application you are trying to access that requires MFA.
Select Temporary Passcode from the drop down
Enter the passcode and click Enter.

screenshot showing temp passcode option at duo custom iframe

Cancel Temporary Passcode:

Visit the NetID Center at https://identity.uillinois.edu, select Manage my 2FA under 2-Factor Authentication
Under My Devices & Settings select (-) Temporary Passcode and then the trash can to delete/expire the code.

expire code

"Duo Remembered Devices" Feature not working

If you choose for Duo to remember you or trust your browser, a trusted session will be created for 24 hours. If you have restrictive cookie settings in your browser, you may run into issues utilizing this feature. This Duo documentation page has more details: Can Duo's Remembered Devices feature work if third-party cookies are blocked?.

Remember: Do not trust the browser when using a public or shared computer!

If the above didn't work, try the following troubleshooting steps:

Clear your browser's cache/cookies (Browsers, Clearing Cache and Cookies).
Try using a different browser for a few hours.

If these steps do not solve the issue, please send the following information to your campus help desk:

Operating System (Android, iOS, Windows, Mac etc.).
Browser (Chrome, Firefox, Safari, etc.).
The last site where you experienced this problem (Canvas, Outlook, etc.).
Any browser plugins/extensions.
If you are using the VPN and which campus (UIC, UIS, UIUC, AITS).

I don't have internet access (no mobile phone connectivity)

The following options are perfect for traveling when you may not have internet access on your mobile phone, or if you do not have access to your typical device.

The Duo Mobile app for smartphones allows you to generate a passcode to login, even if your phone is not connected to the internet. Instructions on using this method can be found here: Multi-Factor Authentication (MFA), Device Management.
Hardware tokens work without an internet connection. More information can be found here: Multi-Factor Authentication (MFA), Yubikey, Purchase and Use.
As mentioned at the top of the article, you can get a temporary bypass code Temporary passcode: NetID Center.

Notifications from Duo When Adding/Removing Devices

To help protect your Duo account from unauthorized activity, you will receive a Duo push and an email notification when you add or remove an authentication device in Duo.

More information available Multi-Factor Authentication (MFA), Device Management.

Duo prompt display issues

Please see this article for assistance: Multi-Factor Authentication (MFA), Duo Prompt Display Issues.

Duo says my account has been locked out

You will see one of two error messages:

"Account disabled. Your Duo account is disabled and cannot access this application. Please contact your IT help desk."
"Your account has been locked out due to excessive authentication failures. Please contact your administrator."

This is triggered after 10 failed login attempts. You will need to wait 5 minutes after the last attempt before trying again. If you need assistance with managing your devices, please see this article: Multi-Factor Authentication (MFA), Device Management.

I would like to do MFA with Microsoft instead of Duo

Microsoft Authenticator - The Microsoft Authenticator app is available on iOS and iPadOS (15.0 or later) as well as Android (8.0 and later). Use the following link to install, make sure to pick your device listed (initially it gives you the iOS, you can select Android if you have an Android device.) MFA Setup Link