2FA/Duo

Request a security key | Sign up for 2FA | Adding a device | Adding a second device | Configure your device settingsAuthenticate using DUO

Prerequisites

To sign up for 2FA, you will need either a mobile phone, tablet, or security key (e.g. YubiKey, U2F).

  • If you are an employee, you can request a security key.
  • If you are using a mobile phone or tablet, download the DUO Mobile app 

Sign up for 2FA

You can follow these instructions to add your first two-factor authentication method.

  • In your browser, go to https://2fa.uwaterloo.ca/duo/enroll
  • Enter your WatIAMuserid@uwaterloo.ca and your WatIAM password where prompted then click "Sign in".
  • Select the type of device from the list provided then click "Continue" to begin adding it.
  • Navigate to the instructions for adding your device: mobile phone, tablet, security key.

Adding a device

Mobile phone | TabletSecurity key

These instructions explain how to enroll/add the various types of devices in DUO.

Mobile phone

  • Go to https://uwaterloo.login.duosecurity.com/devices.
  • Select the country where your phone number's area code is located from the dropdown menu then enter your phone number
  • Verify it is correct then click "Continue".
  • Select the type of phone. (e.g. iPhone, Android, etc…) then click "Continue".
  • Click "I have Duo Mobile installed".
  • Activate DUO Mobile.
    • On your computer, in the DUO setup wizard, a QR code will appear in the middle of the window.
    • Scan the barcode with your phone's camera. 
    • Click the green "Continue" button at the bottom of the setup wizard. This button will be locked until scanning is complete.
  • Optionally configure your device's settings
  • Your smartphone is now set up for 2FA authentication with DUO.

Tablet

  • Go to https://uwaterloo.login.duosecurity.com/devices.
  • Select your tablet's operating system (e.g iOS, Android, etc.) then click "Continue".
  • Click "I have Duo Mobile installed".
  • Activate DUO Mobile.
    • In the DUO setup wizard, a QR code will appear in the middle of the window.
    • Scan the barcode with your tablet's camera. 
    • Click the green "Continue" button at the bottom of the setup wizard. This button will be locked until scanning is complete.
  • Optionally configure your device's settings
  • Your tablet is now set up for 2FA authentication with DUO.

Security key (device must support OTP for VPN authentication)

  • Go to https://uwaterloo.login.duosecurity.com/devices.
  • Ensure that pop-up windows are enabled on your computer.
  • A prompt will appear to insert and tap your security key immediately after pressing “Continue” in the DUO setup wizard.
  • This will set up your security key for 2FA authentications.
  • Optionally configure your device's settings
  • Your security key is now set up for 2FA authentication with DUO.

Adding multiple devices

If you have already enrolled a device, you can also add another device as an authentication method by following the steps below:

Configure your device settings

Select a default device / 2FA method | reactivate DUO | Change device's name | Delete a device

After you have added one or more devices to your 2FA you can configure your device settings using the 2FA Device Management Portal. The options available in this portal include:

  • Select a default device and two-factor method
  • Reactivate DUO in the case you have gotten a new device 
  • Change your device's name 
  • Delete your device

Select a default device/2FA method

DUO can be configured to automatically send you an authentication request using your preferred authentication method. If the settings of your device are not configured you will be asked to choose an authentication method each time you use 2FA.

  • In the 2FA Device Management Portal where it says "Default Device" select your desired default device from the dropdown menu.
  • Select your desired authentication method from the dropdown menu "When I log in".
    • These options will vary depending on what type of device you are using.
  • Click the green "Save" button. 

Reactivate DUO

Change device name

  • In the 2FA Device Management Portal click the blue "Device Options" button beside the desired device. 
  • Click the blue "Change Device Name"  button.
  • Enter the desired device name then click the green "Save" button. 

Delete a device

  • In the 2FA Device Management Portal click the blue "Device Options" button beside the desired device. 
  • Click the red trash can icon.
  • Click "Remove".
    • This action cannot be undone. Please ensure you are removing the correct device.

Authenticate using DUO

Campus VPN | ADFS

Campus VPN

To connect to the campus VPN, you must enter your WatIAM credentials, followed by a second password. The second password defines the second factor you've chosen.

Second factor Second password field
Duo push notification type: push (for multiples, push1 or push2 ...)
Phone call type: phone (for multiples phone1 or phone2 ...)
Test message (SMS) type: sms (for multiples, sms1 or sms2 ...)
IST provided YubiKey

place cursor in second password field and touch token

(non-IST-provided hardware auth devices must be programmed for OTP and registered with IST)

Duo token or bypass code type the passcode in the second password field

ADFS (Active Directory Federation Service)

When you log in to a university site such as Learn, Portal or, Quest, you are logging in using the ADFS portal. To login, via the ADFS portal, you will need your WatIAM credentials followed by a successful 2FA authentication of your login attempt.

To authenticate your login attempt through ADFS:

  • Select your preferred method of 2FA authentication. If you have pre-selected a default preferred authentication method in DUO, a 2FA request will be sent automatically.
  • Approve the authentication request using your preferred method.

Issues or concerns? Please contact the Science Computing Helpdesk.