This document provides instructions for purchasing and enrolling individual Duo hardware tokens or departmental bulk orders.
EPCS Providers:If you use two-factor authentication for Electronic Prescription of Controlled Substances (EPCS), work with your unit liaison to get provisioned. Do not purchase Duo hardware tokens from the Computer Showcase or follow the instructions here.
- Before You Begin
- Individual Hardware Tokens
- Bulk Orders by Departments
- Reassign a Hardware Token
- A Duo hardware token needs to be enrolled for an individual before it can be used. If you already have another device enrolled, you can enroll your hardware token online.
- A new Duo hardware token has a battery life of five years.
- If you are unsure which two-factor option you want to use, see Two-Factor Authentication Options for more information.
Hardware tokens are sold by the Computer Showcase for $25 each. They may be returned for a full refund. To purchase a Duo hardware token, visit the Computer Showcase in person or order online. Refer to the product information for details about the item.
Note: Any individual with a U-M ID may purchase a hardware token. If you want to use a Shortcode for payment, you must be an authorized Shortcode signer for your department. If you are not an authorized signer, you may ask an authorized signer to submit an order online and designate you to handle the pick up. Please see the departmental ordering page for more info.
Before you can use your hardware token when logging in, it needs to be enrolled with your U-M Duo account. If you already have another device enrolled so that you can complete a Duo two-factor authentication prompt when logging in, you can enroll a hardware token online.
- To enroll your hardware token online, go to the UMICH Account Management website.
- On the Two-Factor (Duo) tab, click Enroll Hardware Token.
- Complete the Duo two-factor authentication prompt.
- On the Hardware Token Enrollment page, in the Token Serial Number box, enter the serial number from the back of your hardware token, then click Enroll.
- You can immediately test your token by clicking the green Enter a Passcode button. You will then be prompted for the passcode generated by your hardware token.
If you prefer, you can ask the ITS Service Center staff to enroll your hardware token for you over the phone (you will be asked to provide information to verify your identity).
If you lose your Duo hardware token or suspect it has been stolen, please report it to the ITS Service Center. Service Center staff will mark that token serial number as missing to prevent others from using it.
If the login screen displays “Incorrect passcode. Please try again.” your hardware token may be out of sync. You can re-sync it by generating a new passcode three more times and entering each passcode. On the third entry, you should be logged in successfully.
To remove a hardware token from your U-M Duo account, go to Turn on Two-Factor (Duo) for Weblogin, log in, and click Enroll a backup or alternate device to get to My Settings & Devices where you can delete the device. See Change You Duo Options and Settings for the detailed steps.
Departments may choose to order hardware tokens and distribute them to their staff.
- Visit the Computer Showcase to purchase the hardware tokens in person or order online. Refer to the Showcase's Duo Security Token information for a product description.
- After receiving the hardware tokens, get them enrolled using one of these methods:
- Ask the individuals who will use the tokens to enroll them themselves at UMICH Account Management.
- Download this Excel spreadsheet template to record the serial number from the back of each hardware token with the uniqname of the individual to whom it will be given. Record the serial number from the back of the token without dashes, and them complete the steps below.
- Send the spreadsheet to the ITS Service Center to request that the hardware tokens be enrolled with the individuals. The person who submits the request will be contacted to verify their identity.
- Distribute the hardware tokens to the assigned individuals.
To reassign a hardware token from one person to another, either:
- If the previous owner of the hardware token deleted the hardware token from his or her Two-Factor (Duo) - My Settings & Devices, the new owner can enroll the hardware token online following the instructions above. If the previous owner did not delete the hardware token, the new owner can call the ITS Service Center at 734-764-4357 (4-HELP) to enroll the hardware token.
- Submit a request to the ITS Service Center with the serial number from the back of the hardware token and the uniqname of the individual to whom it will given. The person who submits the request will be contacted to verify their identity.