DoIT - MFA-Duo - Information for Extension Employees

All Division of Extension employees are required to use Multi-Factor Authentication (MFA) - Duo to access UW-Madison applications and services. Below Extension employees can find important information for new hires that need to get registered, what is expected of them in terms of using MFA-Duo, as well as links to important information managed by DoIT on the UW-Madison campus.

New employees must enroll in MFA-Duo before they are able to use the central login service (NetID). This is used by MyUW, O365, Google, Box, etc. so it is imperative that they complete the enrollment and registration as soon as possible after beginning employment.

Background

Multi-factor authentication is part of the UW-Madison login process that verifies an employee's identity. It combines something an employee knows (NetID and password) with something they have (smartphone, tablet, fob, etc.), preventing anyone but them from logging into a system. UW-Madison has partnered with Duo to provide this service
UW-Madison requires all employees to use MFA-Duo to access UW-Madison online content (e.g. MyUW, O365, Canvas, etc.). They will need to log in by:
- Entering their NetID and password, and
- Confirming their login with MFA-Duo.
Employees are responsible for enrolling in MFA-Duo, adding and managing their MFA-Duo devices, and determining the best way to authenticate when they do not have their device.

New Employee Information

1) Complete MFA-Duo Enrollment & Registration

New employees are required to enroll in MFA-Duo and register a device before they can access applications and services that require a NetID login. Select one of the "First Time Setup" options below and follow the instructions to enroll and register a device.

MFA-Duo - First Time Setup for Smartphone or Tablet

Extension recommends the use of smartphones for MFA-Duo due to its decentralized workforce in the counties of Wisconsin. New employees should follow the instructions below to enroll, add and manage devices, and do what's necessary if they do not have a device.

Navigate to the MFA-Duo homepage "Getting started: multi-factor authentication for faculty & staff".
Watch the video "MFA-Duo: First time setup".
Follow the remaining instructions under "How to get MFA-Duo on your device". Begin by logging in to the MFA Portal.

MFA-Duo - First Time Setup for Token/Fob

Extension employees who do not have a smartphone, or choose not to use it can use a token/fob. This is a small hardware device that generates a unique 6-digit passcode to validate the user in the MFA process.
Extension employees who would like to use a token/fob should contact hr@extension.wisc.edu and provide the following information. HR will create a ticket with DoIT to ship the device to the employee.
- Mailing Address
- Phone Number
- Name
- Whether or not you prefer a token or a USB

MFA-Duo - Accessibility & Usability Information

There are several known barriers with accessibility and usability. If you encounter a barrier or need assistance, please contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.

2) Generate Backup Passcodes

It is recommended that employees generate backup passcodes for use in cases where they may not have access to their MFA device (e.g. forgotten smartphone, secured locations, etc.).

MFA-Duo - Generating Backup Passcodes for Future Use

It is important to remember that:
- Backup codes should be stored in a secure but accessible location (such as a locked drawer or cabinet) while not in use.
- Generating new backup codes will invalidate your previous backup codes.
- Backup codes will expire after four months; The expiration date is displayed on the print-out below the passcodes.
- Each code can only be used once.