This document provides instructions for obtaining and enrolling individual Duo hardware tokens or departmental bulk orders.
EPCS Providers:If you use two-factor authentication for Electronic Prescription of Controlled Substances (EPCS), work with your unit liaison to get provisioned. Do not purchase Duo hardware tokens from the Computer Showcase or follow the instructions here.
- Before You Begin
- Individual Hardware Tokens
- Bulk Orders by Departments
- Reassign a Hardware Token
- If you are unsure which two-factor option you want to use, see Two-Factor Authentication Options for more information.
- A new Duo hardware token has a battery life of five years.
Hardware tokens are available at Computer Showcase. They may be returned if they are no longer needed. To get a Duo hardware token, visit Computer Showcase in person or order online. Refer to the product information for details about the item.
Note: Any individual with a U-M ID may get a hardware token. If you want to submit a group order for you department, you must be an authorized Shortcode signer for your department. If you are not an authorized signer, you may ask an authorized signer to submit an order online and designate you to handle the pick up. Please see the departmental ordering page for more info.
Before you can use your hardware token when logging in, it needs to be enrolled with your U-M Duo account.
- To enroll your hardware token online, go to Two-Factor (Duo) for Weblogin.
- Select the Token Type.
- Enter the serial number from the back of your hardware token in the Token Serial Number box.
- Click Enroll.
If you prefer, you can ask the ITS Service Center staff to enroll your hardware token for you over the phone (you will be asked to provide information to verify your identity).
If you lose your Duo hardware token or suspect it has been stolen, please report it to the ITS Service Center. Service Center staff will mark that token serial number as missing to prevent others from using it.
If the login screen displays “Incorrect passcode. Please try again.” your hardware token may be out of sync. You can re-sync it by generating a new passcode three more times and entering each passcode. On the third entry, you should be logged in successfully.
To remove a hardware token from your U-M Duo account, go to Turn on Two-Factor (Duo) for Weblogin, log in, and click Enroll a backup or alternate device to get to My Settings & Devices where you can delete the device. See Change You Duo Options and Settings for the detailed steps.
Departments may choose to order hardware tokens and distribute them to their staff.
- Visit the Computer Showcase to get the hardware tokens in person or order online. Refer to the Showcase's Duo Security Token information for a product description.
- After receiving the hardware tokens, get them enrolled using one of these methods:
- Ask the individuals who will use the tokens to enroll them themselves at Two-Factor (Duo) for Weblogin.
- Download this Excel spreadsheet template to record the serial number from the back of each hardware token with the uniqname of the individual to whom it will be given. Record the serial number from the back of the token without dashes, and them complete the steps below.
- Send the spreadsheet to the ITS Service Center to request that the hardware tokens be enrolled with the individuals. The person who submits the request will be contacted to verify their identity.
- Distribute the hardware tokens to the assigned individuals.
To reassign a hardware token from one person to another, either:
- If the previous owner of the hardware token deleted the hardware token from My Settings & Devices, the new owner can enroll the hardware token online following the instructions above. If the previous owner did not delete the hardware token, the new owner can call the ITS Service Center at 734-764-4357 (4-HELP) to enroll the hardware token.
- Submit a request to the ITS Service Center with the serial number from the back of the hardware token and the uniqname of the individual to whom it will given. The person who submits the request will be contacted to verify their identity.