Two-Step Login (Duo) Project

The University of Oregon has completed a phased effort to enroll all UO students, faculty, and staff in two-step login with Duo Security.

How Does Duo Work?

Three-part graphic: Step 1 is a laptop labeled Duck ID and password, step 2 is a cell phone labeled Prove it's you, and step three is a checkmark labeled Secure access.

  • Two-step login adds a powerful layer of security to your Duck ID account.
  • When you log in to a protected UO service, Duo will prompt you to confirm your identity using a secondary device, such as your mobile phone, tablet, landline, or small hardware token.
    • Protected services include Canvas, Zoom, MyTrack, Concur, and any other UO service that uses Shibboleth single sign-on, with that familiar "Login Required" screen (see below).
    • They also include UOmail and Microsoft Office 365 (Word, Teams, Outlook, OneDrive, etc.).
  • You'll get to choose which devices to use with Duo. The most popular option is the Duo Mobile app on your smartphone. Visit Getting Started with Two-Step Login (Duo).
  • Using the Remember me for 7 days option, most people will only have to do the verification step once per week for most UO services (per browser or app, per device).
  • If you get a Duo push notification or phone call when you're not logging in, that means a cybercriminal is trying to use your account! To stop them, tap "Deny" in the Duo Mobile app or "9" on a phone call.

Screenshot of UO's green-and-yellow Login Required screen (Shibboleth single sign-on).
UO's "Login Required" screen for Shibboleth single sign-on.


UO Group Duo Enrollment Status
IT staff Completed 2019
Banner users and other employees with access to high-risk data Completed 2019
All employees
  • Faculty
  • Staff
  • Graduate employees
Completed July 29, 2020
All students
  • Opt-in: Completed March 12, 2021
  • Mandatory: Completed June 2, 2021
  • Incoming students: Completed August 7, 2021


  • New UO students — those who claimed their Duck IDs after March 12, 2021 — were required to start using Duo in August 2021.
  • Duo became mandatory for all other UO students during spring term 2021.


  • Duo has been required for all UO faculty, staff, and graduate employees since July 29, 2020.
  • Emeritus faculty and retired staff aren't required to enroll in Duo at this time.

Why Two-Step Login?

Two-step login is a critical part of our strategy to fortify UO's defenses against cyberattacks, enabled by strategic funding approved in May 2019.

  • Universities around the world, including the UO, are high-priority targets for hackers. An example is the phishing attack of August 2018. Those attacks have only increased during the COVID-19 outbreak.
  • Stolen UO credentials can be leveraged to gain unauthorized access to personal information, research data, and intellectual property.
  • Multi-factor authentication blocks almost 100% of attacks based on credential theft, according to research by Google and Microsoft.
  • Two-step login allows you to protect your account from wherever you are, whether on campus, at home, or on the road.

Instructions and FAQs

The UO Service Portal contains a lot of information about two-step login. We suggest starting here:

More Information

Contact Us

UO IT staff are here to help you with Duo!