Known issues and troubleshooting for Two-Step Login (Duo) at IU

Requesting multiple Duo tokens

IT Pros or group account owners may decide that members of their group accounts need a separate token for each account.

Each person may be issued one Duo token by the Support Center, and this token can be added to all accounts the person has access to. IT Pros and group account owners do not need to request batches of tokens to have on hand for their users.

Users cannot register Duo tokens themselves

Seeing multiple Indiana University accounts in your Duo Mobile app

Any device enrolled as a tablet will be required to scan a new QR code for each additional account when activating the Duo Mobile app. This will result in multiple "Indiana University" entries displayed in the Duo Mobile app.

Each account will be named "Indiana University" by default. To avoid confusion with multiple accounts, users should edit the name of a new account immediately after adding it. The account name can be edited by holding your finger on the account in the list, then selecting "Edit Account" from the menu that appears.

All users can make device and settings changes in the account's Duo Control Panel

All users added to a group account can edit devices in the account's Duo Control Panel. This includes adding and deleting devices, changing a device's name, modifying the device's settings, and setting a new default device.

This is expected behavior in Duo. IT Pros should implement best practices for maintaining the number of people who have access to the group account, and they should ensure that only those who need access to the group account have devices in the device list.

The device list is not sorted in a logical order

Users cannot sort the device list, and the devices have generic names (for example, Apple iOS or Google Android).

The device list cannot be sorted. Devices can be renamed, but this will not sort them any differently. IT Pros and account owners should implement best practices when naming devices (for example, username - iPhone); however, users should be aware that their devices will be renamed for all accounts in Duo, including their personal accounts. Additionally, there is nothing to prevent any user from changing a device name back without the knowledge of the group account owner.

Repeated push notifications being sent to the wrong device

The first device on the list will be the first device everyone sees. This will likely result in several other users mistakenly sending push notifications to this device.

For group accounts, users should consider using a passcode instead. It doesn't matter what device is selected in the drop-down menu; a passcode generated from any device associated with the account will work.

It's a very bad idea to set any phone as the default device for a group account and enable automatic push notifications. Users who attempt to do this may not realize that their phones will receive an automatic push notification every time anyone tries to access the group account.

The owner of the group account left IU

If the owner of a group account is the only person with a device enrolled and leaves IU without transferring ownership (see Transfer ownership of a group or departmental account), then no one else will be able to log into that group account.

Ensure that all group accounts are properly transferred to new owners before employees leave IU; see Transfer ownership of a group or departmental account.