FAQs
Content:
General
UTORMFA is required for staff, faculty, librarians and students at U of T.
It depends on the profile of the application:
- If you are connected to a U of T network (excluding Wi-Fi and VPN connections) and the application is listed as a standard profile application, you will not be prompted to authenticate with Duo and you can continue to access the application as usual.
- If you are not connected to a U of T network and the application is listed as a standard profile application, you will only be prompted to authenticate with Duo once every 24 hours, if you decide to trust the device that is accessing the U of T application.
- If you are trying to access an enhanced profile application, you will be prompted to authenticate with Duo every single time that you are timed out. Additionally, if you are not enrolled in MFA, you will be denied access to the U of T application.
Please refer to the UTORMFA security profiles for more details on the application categories.
Refer to the UTORMFA protected applications for the list of applications.
No, you should set aside 10 minutes to complete the entire process at once. If you stop before completing the process, you will need to contact the help desk.
By default, you will be prompted on the device that you used last time. If you would like to choose a different authentication method, select “Other options” as indicated in the screenshot below.
When you access a UTORMFA protected service, you will be asked “Is this your device?” after responding to the push notification. If you are using your personal device, you can select “Yes, this is my device” to remember your MFA session for seven days. If you are using a public or shared computer, do not use this feature.
No, there is no action you need to take as long as your UTORid remains the same.
Hardware tokens are available as an alternative to generate a passcode. Please contact the help desk to order a hardware token. You will need to get approval for the cost from your department/division.
When you access a UTORMFA protected service, choose the “Hardware token” option. Then press the button on the hardware token to generate a one-time passcode and enter it in the highlighted field.
Yes, you can. Log in to the device management portal to add a new UTORMFA device. After you select “Add another device” follow the instructions provided in the portal.
If you are using the same number, log in to the device management portal. From there, you will see a screen that asks you to either “Send me a push” or “Enter a passcode” to authenticate yourself. Choose one of the two options. After authenticating yourself, you can select “Device options” next to the device you want to recover.
The Duo mobile app can automatically generate a passcode if you don’t have access to Wi-Fi or data. To generate a passcode:
- Launch the Duo app and select “University of Toronto”.
- A code will be generated. Enter the code when you log in.
If the device you lost is your only device for UTORMFA, contact your campus help desk to get a bypass code. Log in to the device management portal, select “Device options” next to the device you lost and select the trash button to remove your device.
Once your lost device has been removed, select “Reactivate Duo mobile” to generate a new barcode for your UTORMFA account. On your new phone, use the Duo mobile app to scan the barcode and add your UTORMFA account to Duo.
Contact the help desk for a one-time use bypass code. This code will allow you to log in to your applications.
Please contact the help desk for assistance.
Duo mobile app
Only the Duo mobile app can be activated for use with Duo’s service. You can use the Duo app to replace other passcode generating apps for third-party accounts, but you can’t use other apps to replace Duo mobile.
For iOS and Android phones, the data collected includes smartphone model, Duo mobile app version, operating system version and screen lock type.
Visit the Duo website for information about permissions and privacy.
You can test if your Duo mobile app and UTORMFA account are set up properly by logging in to the test site. If you receive a UTORMFA login prompt and access the website successfully, your UTORMFA account and mobile app are correctly set up.
The numbers are the one-time passcode, which can be used to access UTORMFA protected services. When you try to access a UTORMFA protected service, you can either authenticate by Duo push or a one-time passcode.
To receive a passcode, select “Duo mobile passcode” and enter the one-time passcode in the highlighted field.
The approve/deny notification will display one of three names – Weblogin Standard, Weblogin Hybrid or Weblogin Enhanced. The name you see during authentication depends on the type of U of T application you are accessing, its profile and the criticality of its data. Refer to the UTORMFA security profiles for details on the application categories.
Pause before you approve an MFA notification sent to your device. Only approve the notification if you logged in to an application that requires MFA within the last 60 seconds. Contact security.response@utoronto.ca if you are being spammed with push notifications, or use the report a phish button in Outlook.
Bypass codes
The bypass code service enables UTORMFA users to generate 10 codes that enable them to log in if their mobile device is unavailable.
Visit the bypass codes website to set up your codes.
You should generate bypass codes as soon as possible. Codes cannot be generated after a device is lost or stolen. They must be generated when your mobile device is in your possession.
Print out or write down your bypass codes and store them in a safe place. Don’t save your bypass codes on your computer.
Students
Yes, all students are required to use UTORMFA.
Students have 14 days from the conversion of their JOINid to UTORid to sign up for UTORMFA. After this period, students will not be able to log in to any services until they have completed the UTORMFA enrolment process.
If you don’t have a compatible mobile phone, you can request a hardware token.
Information Security recommends that you set up your bypass codes immediately after enrolling in UTORMFA. Visit the bypass codes website to set up your codes.
These codes can be stored in your wallet to use if your mobile phone is not available. If you don’t have your bypass codes or your phone with you when you need to authenticate, please contact the help desk for assistance.
Bypass codes provide a simple alternative to your phone in situations where your phone is not permitted. Faculty and instructors have been informed that procedures may need to change to accommodate the need for MFA during an exam or assessment.
Yes, MFA authentication will work internationally. It does not depend on your phone number.
UTORMFA will remain active for one session plus one month after the last registered session. At this point, the UTORMFA account will be disabled.