Multi-Factor Authentication Enrollment and Configuration Guide

Step 1: Check availability

MFA enrollment is required for all Mines’ employees – faculty and staff – as well as available for any student-employees.

Step 2: Decide how you want to authenticate

Before enrolling you should decide which type of device you would like use for authentication. Don’t worry – this is not a permanent decision. After enrolling your first device you may add or remove as many devices of each type as you like as you discover the mechanism that works best for you.

• Mobile Phone or Tablet – Using a mobile phone or tablet will be the best choice for most people. The Duo App installed on your device will pop up a prompt while you are logging in. Pressing the green OK button is all that needs to be done to complete the authentication process. Detailed instructions and pictures for all supported devices is available in the Duo guide.
• Hardware Token – Those who do not want to use a mobile device are welcome to request a hardware token. This token displays a random number that is constantly changing. Each time you authenticate you will simply enter the number displayed on the device into the computer. More detail on this option is available in the Hardware Token section of the Duo guide.
• Third-Party U2F Tokens – If you own a third-party U2F token like the popular YubiKey you may make use of that for authentication. And of course, there is more detail in the U2F section of the Duo guide.

Step 3: Request enrollment

Once you have decided how you want to authenticate you need to enroll into the service through one of two ways. (Please note: student-workers need to enroll via step 2 below because we need your supervisor’s approval):

1. (Easiest/quickest) Visit the enrollment self-service portal at https://mfa.mines.edu/ and follow the instructions given at https://helpcenter.mines.edu/TDClient/KB/ArticleDet?ID=74455. This entire enrollment process should take only a few minutes to complete. This method will only work with devices you have immediately available like a phone or tablet; if you are requesting a hardware fob then you need to use step 2 below.
   NOTE: if you are off-campus you need to connect to VPN to interact with the web service at mfa.mines.edu; typically this should be via https://ras.mines.edu/.
2. Submit this request form. After receiving your request ITS will add your account to the Duo service, a process that usually takes 1-2 business days to complete. What happens next depends on the authentication mechanism you have selected.

• If you selected Duo Mobile or Third-Party Token you will receive an email with a link that allows you to start the enrollment process.
• If you decided to start with a Mines-provided hardware token you will receive an email when the token is ready to be picked up at the ITS Mines Service Center (CT156). There is nothing more you need to do. We will take care of everything while you are collecting your device.

Step 4: Install the Duo Mobile App (Mobile Devices only)

If you will be using a mobile device (i.e., a phone or a tablet) you need to install the Duo Mobile App for your device. Duo provides Apps for iOS, Android, and Windows Phone through your operating system’s application store.

Step 5: Enroll your device (Mobile Device or U2F Token only)

Once the Duo Mobile App is installed you are ready to enroll your device. Look for the enrollment email in your Mines inbox. Please look carefully at the email and URL embedded in the message (see the following example). If you did not request enrollment, or if the URL does include the HTTPS protocol and the domain “duosecurity.com,” do not respond to the message but do contact ITS immediately (303.384.2345). If the enrollment email does contain those elements, paste the link into your web browser to visit the page.

Sample enrollment email from duosecurity.com

After following the link, you will be presented with a webpage that will guide you through the process of configuring your device. The process will be a little different depending on the type of device you are adding but, in all cases, it should only take a minute or two.

Completing the enrollment process

Step 6: Give MFA a Test Drive

Multi-factor protection for your account will begin as soon as you have completed the enrollment process. You should confirm the process works by trying to authenticate to one of the protected services (Canvas makes a good test case).

For most people this is all you should need to do. If you have any problems please check our MFA Frequently Ask Questions page or contact the Mines Service Center (CT156 or 303.384.2122) and we will be happy to help.