Multi-Factor Authentication (MFA), Troubleshooting

Attention: The phone call option for performing multi-factor authentication will be disabled on June 12. If you currently use this, please select an alternative authentication option, as mentioned in this KB.

This article can help with common issues users may encounter when trying to use multi-factor authentication (MFA).

 
Requesting a Temporary Passcode

Should you lose, misplace, or forget your MFA device and cannot authenticate, you can request a temporary passcode. These can also be requested if you are going to a testing center and will not have access to your device.

  • Passcodes are good for 3 days or 100 uses, whichever comes first. You can request 24 passcodes per year, so these should not be relied upon as a primary authentication method.

You need to request a passcode in advance (i.e. you currently have your device)

  1. Visit the NetID Center.
  2. Select Temporary passcode at the bottom of the page.

    temporary passcode

  3. Click "Yes, I have my device".
  4. Authenticate like normal using the device.
  5. Your passcode will then be displayed along with the expiration date.

    Temporary Passcode

You do not have your device and need a passcode now

  1. Visit the NetID Center.
  2. Select Temporary passcode at the bottom of the page.

    temporary passcode

  3. Click "No, I don't have my device".
  4. An email with a passcode will be sent to your password recovery email. The email will be from noreply@uillinois.edu and subject will be UI Verify Temporary Passcode.

    emailed code

    If you do not have recovery options set up or cannot access your recovery options, you will need to call your University Service Desk to get a temporary passcode.

    Once you receive a temporary passcode, please visit https://identity.uillinois.edu to set up your recovery email under the Recovery Settings.

    For instructions on setting up recovery options, see NetID Center, Set and modify your recovery options.

How to use a temporary passcode

Duo Universal Prompt (Office 365, Outlook, Canvas, Box, Zoom, Moodle, etc.):

  1. Go to the application you are trying to access that requires MFA and login with your NetID and password.
  2. Select the Bypass code option.
  3. Enter the code and click Verify.

Screenshot highlighting the bypass code option at the Duo Universal Prompt 

AITS Duo Prompt (Banner, HR Reporting, My UI Info, NetID Center, Direct Deposit, etc.):

  1. Go to the application you are trying to access that requires MFA.
  2. Select Temporary Passcode from the drop down
  3. Enter the passcode and click Enter.

  screenshot showing temp passcode option at duo custom iframe

Cancel Temporary Passcode:

If you no longer need to use the temporary passcode you requested, you can cancel it for security.

  1. Visit https://identity.uillinois.edu select Manage my 2FA under 2-Factor Authentication
  2. Under My Devices & Settings select the + next to Temporary Passcode and then the trash can to delete/expire the code.

expire code

Other Troubleshooting Topics

Duo Remembered Devices Feature

Duo Remembered Devices Feature

Depending on which Duo Prompt you are seeing, the remembered devices feature will be referred to as one of the following:

  • A prompt asking you 'Trust this browser?'
  • A checkbox with the label 'Remember me for 24 hours'
If you choose for Duo to remember you or trust your browser, a trusted session will be created for 24 hours between you, your browser, and the endpoint you are logging into. This involves using a browser cookie. If you have restrictive cookie settings in your browser, you may run into issues utilizing this feature. This Duo documentation page has more details: https://help.duo.com/s/article/2189?language=en_US.

Do not trust the browser when using a public or shared computer! This could leave your Duo session available to other users. Trust the browser only when you access applications from your own computer.

The screenshots below show how to enable the remembered devices feature so you can minimize the number of times you see the MFA prompt.

If accessing Microsoft365 (Outlook, Word, Excel, etc.) or Shibboleth (Canvas, Box, Zoom, Moodle, etc.):

If you're authenticating with MFA for the first time in your browser, you will see the below screen after you authenticate:

Screenshot showing trust this browser window after authenticating with Duo

Once the trusted session cookie expires (after 24 hours), you will see the below screen when authenticating. The remembered devices feature is enabled by default, but you can uncheck the checkbox shown below to disable it if desired:

Screenshot showing the trust browser checkbox at a duo prompt after trusted session cookie expires

If accessing AITS Applications (Banner, HR Reporting, My UI Info, NetID Center, Direct Deposit, etc.):

The remembered devices feature is enabled by default, but you can uncheck the checkbox shown below to disable it if desired:

Remember me

I don't have internet access (no mobile phone connectivity)

There are a couple options for authenticating when your smartphone does not have a network connection. The following options are perfect for traveling when you may not have internet access on your mobile phone, or if you do not have access to your typical device.

  1. Hardware tokens work without an internet connection. This means you can use them anywhere in the world to log into your account. More information can be found here: Multi-Factor Authentication (MFA), Hardware Tokens and Security Keys.
  2. The Duo Mobile app for smartphones allows you to generate a passcode to login, even if your phone is not connected to the internet. This is a free and easy way to authenticate wherever you are regardless of network connection. Instructions on using this method can be found here: Multi-Factor Authentication (MFA), Device Management.

Duo prompt display issues

Please see this article for assistance: Multi-Factor Authentication (MFA), Duo Prompt Display Issues.

Duo says my account has been locked out

You will see one of two error messages:

  • "Account disabled. Your Duo account is disabled and cannot access this application. Please contact your IT help desk."
  • "Your account has been locked out due to excessive authentication failures. Please contact your administrator."

This is triggered after 10 failed login attempts. You will need to wait 5 minutes after the last attempt before trying again. If you need assistance with managing your devices, please see this article: Multi-Factor Authentication (MFA), Device Management.

 

See Also:



Keywords:2FA, 2-factor authentication, Two-factor authentication, Duo, Duo Security, Verify, UI Verify, enrollment, multi-factor, multifactor, security, AITS, temporary, passcode, bypass code, mfa request enterprise id   Doc ID:85687
Owner:ID M.Group:University of Illinois Technology Services
Created:2018-09-17 14:47 CDTUpdated:2023-05-17 21:48 CDT
Sites:University of Illinois System, University of Illinois Technology Services
CleanURL:https://answers.uillinois.edu/systemoffices/request-temporary-passcode
Feedback:  1   6