MFA-Duo - What is the best way to use MFA-Duo when traveling?

This document describes the best practices for MFA-Duo Authentication when cellular/internet services are unavailable.

You have several options for MFA-Duo that will work both within the US and internationally.

If you change your SIM Card

Changing your SIM card will not affect the way you authenticate (even if it changes your phone number) because the Duo Mobile app is tied to your smartphone's hardware security module (HSM). You should still be able to accept a push or generate a passcode from the Duo Mobile app (even when your smartphone is in airplane mode or lacks cell/ wi-fi service).

To generate a passcode:

  • Simply open the Duo Mobile app and click the UW Madison NetID Login down arrow located at the upper right-hand corner of your smartphone. This will generate a six-digit temporary passcode.
  • Enter the six-digit code provided on your smartphone in the Multi-Factor Authentication portal to complete the authentication process.

Smartphone or tablet with the Duo app installed

Token/Fob or security key

Generate 10 Backup Codes for Future Use

  • Each backup passcode can only be used once, so we recommend crossing them off as you use them.
  • Backup passcode will expire after four months. The expiration date is displayed on the print out below the passcodes
  • Generating new backup passcodes will invalidate your previous backup passcodes, even if you haven't used all of them.
  • For more on this, see MFA-Duo - Generating Backup Passcodes for Future Use

Travel to Countries Subject to Export Control Regulations

  • In order to comply with U.S. regulations, beginning May 2022, Duo will be blocking authentications from users whose IP address originates in a country or region subject to economic and trade sanctions enforced by the U.S. Office of Foreign Assets Control (OFAC).
  • This means that authentications to University of Wisconsin - Madison Duo-protected applications (VPN, O365, Canvas, Google suite, etc.) coming from countries or regions that are currently under economic or trade sanctions from the OFAC will be blocked.
  • Users will receive an "Access Denied. Duo Security does not provide services in your current location." error message or other generic failed login message if attempting to authenticate from these locations.

Problems?

If you don't have access to a smartphone, tablet, or token/fob or security key you can call the DoIT Help Desk at (608) 264-HELP and an agent can assist you by generating a temporary passcode.

See accessibility & usability information

We work with our users to address access and usability barriers in the MFA user experience. Learn details about known access barriers and workarounds at MFA-Duo - Accessibility & Usability Information. If you encounter a barrier or need assistance, please contact the DoIT Help Desk or call (608) 264-4357.

For questions regarding how to get access to the MFA mobile app contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.

How to get access to a Security Key or Duo Token/Fob 

Students

Students, to obtain a token/fob, please contact the DoIT Help Desk (608) 264-4357 or email help@doit.wisc.edu. Students with disabilities can also request a token or security key at the McBurney Disability Resource Center, 702 W. Johnson St., Suite #2104, Madison WI 53715 on the 2nd floor.

Faculty, Staff, and Researchers

Employees can get access to devices for MFA at their Human Resources Office or IT department. For questions contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.