Setting Up Multi-Factor Authentication (MFA) in Canvas Catalog for Sub-Account Admins

Environment

Canvas Catalog

Issue

Multi-Factor Authentication (MFA) has been enabled to the login process for Sub-Account Admins. MFA adds an extra layer of security to your Canvas Catalog account by requiring a second form of verification.

Once set up, after entering your username and password, you will be prompted to enter a 6-digit code generated by Duo each time you log in.

Note:  Duo is the preferred authenticator. However, Duo push is not available, you will receive a 6-digit code from the app

Resolution

First Time MFA Setup using Duo

1. Visit u-m.catalog.instructure.com
2. Enter your username and password
3. Once logged in, you will be directed to the Canvas Multi-Factor Authentication screen to choose an authentication method
4. Select the Authenticator App option. 
5. Open the Duo app on your mobile device (don't scan the QR code on the screen yet)
6. Select the Add+ button in the upper right corner
7. Select Use QR Code at the top of the list
8. Use your phone to scan the QR Code
9. The account name is automatically populated
10. Select Save
11. Enter 6-Digit Passcode into Canvas by returning to the Multi-Factor Authentication screen and entering the 6-digit passcode generated by Duo into the verification field
12. Select Verify
13. Once the passcode is verified, you will be granted access to your Canvas account.
14. Congratulations! Duo has now been configured and ready for use the next time you login.

Subsequent Logins

For subsequent logins, you will only need to enter the Duo passcode manually.

1. Visit u-m.catalog.instructure.com and enter your username and password as usual
2. You will be prompted to enter the 6-digit passcode generated by Duo
3. Open Duo, and click on the Account that says Third Party - University of Michigan - Catalog Canvas [your email address]
4. Enter the displayed code and verify
   NOTE: the passcode in Duo automatically refreshes every 30 seconds. 

Additional Information

Troubleshooting:

1. Ensure that you're entering the most recent passcode generated by the DUO app (it refreshes every 30 seconds)
2. DUO Mobile App Issues: Make sure the DUO Mobile app is up to date. Restart the app if necessary.
3. Canvas Catalog will support cell phone push notifications, however, this is not recommended on personally owned devices and does not work on the beta instance of Canvas Catalog.

Why is MFA being implemented?

• Protecting our users and their information is a top priority. In today's environment, we identify a user by their provided username and password. However, passwords can be stolen or compromised. MFA adds an extra layer of security by requiring a second form of verification

Passcode Expiration:

1. You have 30 seconds to enter the 6-digit passcode displayed on the screen.  A new code is refreshed (regenerated) every 30 seconds.
2. If you encounter an expired passcode, wait until the app generates a new one.

Manage Multi-Factor Authentication

Once MFA is enabled, you can manage your authentication settings (reconfigure settings, access backup codes) from the Account Settings page in the Canvas side of Catalog

1. Login to Canvas Catalog
2. Click Account
3. Click Settings
4. View MFA settings on the far right.