Can't Authenticate with Duo - Enrolled Using Fingerprint or Face ID

Environment

Duo Security two-factor authentication system

Issue

Users enrolled in Duo only have the option to enter a bypass code provided by ITS upon logging in. They have previously registered for Duo using a biometric platform authenticator (such as Fingerprint, Windows Hello, Touch ID, or Face ID).

Resolution

This issue occurs when the only Duo device enrolled on your account is a biometric platform authenticator (such as Fingerprint, Windows Hello, Touch ID, or Face ID). Biometric platform authenticators only work on the specific device they were enrolled on, and they are not recommended by the ITS Service Center. 

In order to resolve this issue, you must register a Duo authentication method that will work on multiple devices. ITS recommends using the Duo Mobile app because it is easy to use and can be used to authenticate on any device. 

1. Log in to duo.it.umich.edu on the device linked to the platform authenticator (Fingerprint, Windows Hello, Touch ID, or Face ID). 
   1. If you are unable to log in on the device, contact the ITS Service Center for a bypass code.
2. Click "Add a device."
3. Click "Duo Mobile" 
4. Follow the steps on-screen to download and activate the app.
5. Once the Duo app has been activated, you can log in on any device by using Duo Push authentication. 

If you are unable to install the Duo app on your device, ITS supported alternatives include: 

• Enrolling your Phone Number in Duo 
• Ordering a Complimentary Duo Hardware Token through the Tech Shop

Additional Information

Note: Choosing to Enroll Biometric ID as your only Duo device will not be possible moving forward. 

Need additional information or assistance? Contact the ITS Service Center.