Turn on multi-factor authentication (MFA)

Multi-factor authenticator (MFA) is an important security feature that requires you to use 2 pieces of evidence to prove your identity when you sign in to your UVic account. The first is always your passphrase. Most people use an authenticator app on their phone as the second one, though there are other options.

MFA is one of the best ways to keep your account secure, even if your passphrase has been compromised. MFA is mandatory for all UVic students and employees.

Get ready

Before you start:

• Make sure you have time. It takes about 20 minutes to set up MFA. Don’t close your browser or tab while you’re in the middle of the process. If you don’t complete the process, you may be locked out of your account.
• Have your computer and device ready. It’s easiest if you can use them both. They need to be connected to the Internet. You can also use a lab computer on campus.
• Choose how you want to verify your identity. We recommend you use the Duo Mobile app on an iPhone or Android device. If that doesn’t work for you, there are other options.

The video and instructions assume you’re using the Duo Mobile app. Contact us if you want help setting up a different method.

Watch this video for detailed instructions with video examples with iOS and Android or, if you're already comfortable using web apps and installing apps on your device, skip to the higher-level instructions below. To read a transcript of the video, view it on YouTube.

Get the Duo Mobile app

Turn on MFA

1. You’ll automatically be prompted to turn on MFA when you sign in to the UVic website. You can skip it a few times, but don’t leave it too long.
2. After you select enrol, you'll be prompted to add a device you'll use to authenticate with. Select Duo Mobile App then Continue.

Add your UVic account to the app

1. When you get to the Duo Universal Prompt (the “Welcome to Duo Security” window), follow the prompts.
2. When you’re asked to select an option to use to log in, select Duo Mobile (Get a notification or code on your phone). Continue to follow the prompts. You'll be prompted to install the app now, but if you're following along, you've already done that. Next, it'll display a QR code.
3. Open Duo on your device. Tap Add ​ (if you've used Duo Mobile before) or Continue (if you haven't), then Use QR code. If you're asked, allow the app to use your camera.
4. Scan the QR code on your screen. When it recognizes it, select Next and follow a few more prompts to give it a name (the default "University of Victoria" is probably good!) and get a quick tutorial for responding to push notifications from the app.

Once you've gone through the tutorial, you're done. Keep in mind that you must have the Duo Mobile app open on your phone to receive push notifications from it.

Alternative authenticator apps and options

You can also use:

• TOTP authenticator apps
  • we’ve tested Microsoft Authenticator, Google Authenticator and Twilio Authy but we expect that others will work
  • to get a QR code to add your UVic account to one of these apps, go to Add a new authenticator token, select the authenticator app from the type of authenticator token drop-down list, and follow the prompts you're given
• Duo hardware token (available from the bookstore)
  • only Duo-branded tokens from the UVic bookstore will work
  • departments can buy tokens for staff use
• one-time bypass codes

Touch ID, Face ID, and Windows Hello might also be options, depending on your device.

SMS, by far the weakest method, isn’t available.

Create bypass codes

We recommend you also create bypass codes for yourself. You can use a one-time bypass code to sign in if you don't have access to your device. You can keep one in your wallet to use as a backup in case you leave it at home or run out of battery power.

Watch this video for a detailed explanation and instructions with video demonstrations or, if you're already comfortable using web apps and installing apps on your device, skip to the higher-level instructions below. To read a transcript of the video, view it on YouTube.

1. Go to Your profile > Manage duo multi-Factor authentication > Manage bypass code(s).
2. Choose either 10 single-use codes or one 24-hour code and select Perform action.

There's not limit to how many times you can create bypass codes. If you use them all, just come back and make more for next time.

Accessibility

Duo Mobile is compatible with screen readers and many other adaptive technologies, but the software and process we've described here don't work for everyone. If you need something different, either because of a disability or access to devices, accommodations are available.

You don't need to be registered with CAL to request an accommodation.