Attention iPhone users: When Duo is enabled for Microsoft 365, you may receive an error on your device that the iPhone or iPad has stopped syncing (a message saying “Your admin has made changes…” may appear in your device’s Mail app). See the tips below or watch this video walk-through for how to resolve this issue.

  • Remove and re-add your Exchange account from your iPhone or iPad.
  • You may have to disconnect/reconnect the wireless network in order for the setup to complete successfully.
  • Note that when setting up a new account, you must enter your e-mail address as ename@colostate.edu.

Duo Expansion to Microsoft 365 Services

Duo Two-Factor Authentication has expanded to include Microsoft 365 applications and email. On Oct. 4, 2021 Duo Two-Factor Authentication will become required for all students, faculty and staff to access their email, login to Microsoft Teams and other Microsoft 365 services.

help.mail.colostate.edu is the primary campus resource to find information regarding Microsoft 365 services. As Duo has expanded to protect these services, we’ve provided links to resources for setting up email on mobile devices as well as what to expect when accessing email and other Microsoft applications with Duo.

Common Duo for M365 Account Set Up Issues

iPhone or iPad stops syncing (a message saying "Your admin has made changes..." may appear in your device's Mail app)


Resolution/Recommendations:
• Remove and re-add your Exchange account from your iPhone or iPad.
• You may have to disconnect/reconnect the wireless network in order for the setup to complete successfully.
• Note that when setting up a new account, you must enter your e-mail address as ename@colostate.edu.

Android Mail app stops syncing with Microsoft 365


Resolution: Download and install the Outlook for Android app or purchase the Nine e-mail client from the Google Play store.

Prompted to authenticate by multiple Microsoft applications


The initial setup of DUO requires you to authenticate with each application (Outlook, Teams, etc.) individually. After the initial setup, applications will “save” your login information.

What to Expect with Duo for Microsoft 365

  • Within 48 hours of activation, expect multiple login prompts from each Microsoft application (Outlook, Teams, etc.) you use. Going forward, future prompting to reauthenticate will be less frequent, usually weeks in between.
  • The Microsoft 365 portal (https://portal.office.com) will prompt for Duo authentication. If the browser is set to save your password, you will not be Duo prompted with each login.
  • For the best experience on iOS or Android, use the Outlook App. You can expect to be prompted by Duo initially.
    • “Built-in” Mail app on iPhone/iOS: Supported with Duo but you may need to remove and re-add your Exchange account – in some cases you must disconnect and reconnect to the wireless network in order for the setup process to complete. An e-mail may also appear (looks suspicious but is legitimate) on your iPhone notifying you that your admin made changes when syncing stops working.
    • “Built-in” Mail app on Android: Not supported with Duo. Outlook for Android or a 3rd party app such as Nine ($14.99) are the only supported clients.
  • IMAP/SMTP Clients (e.g., Thunderbird, Pine, or other 3rd party and older email/calendaring clients) are not affected by Duo expansion

Frequently Asked Questions:

What can I use as a second factor device?


You can register and authenticate using any and all of the following methods:

•    The Duo Mobile App (Recommended): Download the Duo Mobile App from your smartphone or tablet’s app store. This method will allow Duo to push a message to your phone or tablet where you can verify your identity by tapping on the screen.

•    Any Phone Number: You can register your cell phone, desk phone, home phone, etc. and the system will call you to validate your identity.

•    A Hardware Token: These can be purchased from RamTech and will be registered to your account at time of purchase. Hardware tokens generate a six-digit code that you can use to authenticate.

We recommend that you setup more than one device as a 2nd factor authentication method with Duo. If you lose, misplace or simply forget a device, having a second registered device will save the day.

Can I set up more than one device?


Yes, we recommend that you set up more than one device as a 2nd factor authentication method with Duo. If you lose, misplace or simply forget a device, having an additional registered device (like your desk phone or a hardware token) will save the day.

If you do not have an alternate/back-up device registered, you will need to contact the CSU Central IT Support Helpdesk at (970) 491-7276 or help@colostate.edu for assistance with setting up a new device. We also recommend enabling Duo Restore, Duo Mobile’s restore functionality lets you back up Duo-protected accounts for recovery to the same device or to a new device.

What do I do if I'm locked out or don't have a back-up device registered?


If you’ve lost or are unable to use your cell phone, hardware token, or any other device you’ve registered with Duo and do not have an alternate/back-up device registered, you will need to contact the CSU Central IT Support Helpdesk at (970) 491-7276 or help@colostate.edu for assistance with setting up a new device.

We also recommend enabling Duo Restore, Duo Mobile’s restore functionality lets you back up Duo-protected accounts for recovery to the same device or to a new device.

I lost a device registered with Duo – how can I remove this device as my 2nd factor?


If you’ve lost your cell phone, hardware token, or any other device you’ve registered with Duo, you can remove it through the Duo self-service application located on the eID website if you have another device registered.

If you do not have a backup device registered with Duo, you will need to contact the CSU IT Central Support Helpdesk for assistance at (970) 491-7276 or help@colostate.edu. We also recommend enabling Duo Restore, Duo Mobile’s restore functionality lets you back up Duo-protected accounts for recovery to the same device or to a new device.

What is Duo Restore and is it supported?


Duo Mobile’s restore functionality lets you back up Duo-protected accounts for recovery to the same device or to a new device. For instructions on enabling this feature, please see Duo’s guide for Duo Restore.

This functionality is supported and recommended. Note: your device will have to be backed up to iCloud (iOS) or Google Drive (Android) for this to work.

Using Duo Restore still requires you to complete a Duo login to a device enrolled for Two-Step Login.

I got a new phone – do I need to register it?


Yes! Whether your phone number has changed or you have a new device (with the same number), you’ll need to go through the registration process again.

  • If you have an alternate/backup device registered:
    • Log in to secure.colostate.edu with your eName and ePassword.
    • Before authenticating, click on ‘My Settings & Devices’ on the left hand side of the screen

Duo Self Service Prompt, Add a new device and My Settings & Device options

    • You will need to authenticate with your preferred method before you are taken to the next screen.
    • Under My Settings & Devices, find the device you want to remove, click the ‘Device Options’ button, and then click the trash can icon to remove it.
    • You can then click the ‘+Add another device’ link under your registered devices list or ‘Add a new device’ from the menu on the left to set up your new phone.
  • If you do not have an alternate/back-up device registered in Duo, contact the CSU Central IT Support Helpdesk for assistance at (970) 491-7276 or help@colostate.edu.
  • We also recommend enabling Duo Restore, Duo Mobile’s restore functionality lets you back up Duo-protected accounts for recovery to the same device or to a new device.

Which versions of mobile devices/tablets does Duo support?


Duo recommends upgrading to the most recent version of iOS or Android available for your device.

Wondering if your phone or tablet meets the requirements for the Duo Mobile app? See the Duo articles below for more information.

If your device does not meet the requirements for the Duo Mobile app, you can still authenticate with a phone call to that device.

I registered more than one device – how do I select which device to use when prompted by Duo?


Upon logging in with your CSU credentials, the Duo prompt will populate allowing users to choose how to verify their identity.

If you have more than one device registered, make sure to select the one you want to use for this session from the Device dropdown menu.

You can then select which authentication method you want to use with that device.


You can also specify which of your devices you would like to be the default.

  • Log in to secure.colostate.edu with your eName and ePassword.
  • Before authenticating, click on ‘My Settings & Devices’ on the left hand side of the screen. Note: you will need to authenticate before moving to the next menu

Duo Self Service Prompt, Add a new device and My Settings & Device options

Then click the Default Device: drop-down menu and pick your default device for authentication. Click Save if you’re done making changes.

Choose Default Device

Where do I get a hardware token?


You can buy a hardware token at RamTech for $23.75 and the staff will register the token for you.  See the What to Expect: Duo Authentication section of duo.colostate.edu for more information on using a hardware token to authenticate.

Can I register an international phone number?


International phone numbers are supported in DUO. When filling out the device information, enter a plus sign (+), followed by the Country Code, and the phone number, in the Phone Number field. These numbers should be all in one string; no spaces or dashes. For example: +441234567890

I'm not receiving a phone call when selecting that as the authentication method - what's wrong?


If your device does not ring after you’ve selected the Phone Call authentication method, it could be your call spam filters on your phone. We recommend using the Duo Mobile App or Hardware Tokens instead of authenticating with a phone call.

How do I resolve Duo Prompt display issues related to iOS or macOS content restrictions?


If the Duo Prompt does not display as expected while attempting to log in on iOS or macOS, please see this Duo support article for resolution. Having Screen Time enabled can also cause Duo prompt issues.

I connected my OneDrive storage to Adobe on a Mac and can longer access documents with Duo enabled, how do I resolve this?


If you are a Mac user who uses the Adobe “Add a Storage Account” feature to connect the Adobe application directly to your OneDrive folder for document access, you may no longer be able to use this link once Duo is enabled. Instead, when you attempt to access a document in OneDrive from your Adobe application you are prompted to re-authenticate and, after entering credentials, your application either freezes, or presents a blank Duo two-factor authentication screen.

Follow the steps below for a workaround to this issue,

  1. Install the OneDrive application for Mac OS using the App Store if it is not already installed.
  2. Authenticate to OneDrive application. Do not use the Adobe application to authenticate.
  3. OneDrive will sync with your device and create a local folder with the contents of your OneDrive cloud storage account. The local folder will appear under your user profile folder in Finder.
  4. Use the OneDrive local folder to open and save documents from Adobe applications. Any changes to documents in the local folder or the OneDrive cloud storage folder will be updated and kept in sync.

I don't have cellular connectivity. How do I use Duo?


For any situation where you are outside of cellular reception — whether for a short time in an area of low signal around town, because your phone is in airplane mode while traveling, or because you’re abroad in a country with more limited networking infrastructure or restrictive internet policies — Duo supports multiple methods for completing two-factor authentication.

  • If you’re traveling with an international data plan on your smart phone, the Push feature in the Duo Mobile App should work as normal.
  • The Duo hardware token, available for purchase at RamTech, is a device that does not rely on network communication. A push of the button provides a one-time code that can be typed into the Duo prompt.
  • The Duo Mobile App, on a cell phone or tablet, also has a one-time code feature that functions even when the device can’t reach the network.
    • Generate a passcode in the Duo Mobile app by tapping the down arrow next to “Colorado State University”. The app will populate a 6-digit code under the Colorado State University account that can be typed into the Duo prompt.

Something you know + Something you have