Stanford Two Factor Authentication adds a robust extra layer of security for university accounts, protecting research data, financial records, and student information. This guide explains how the system works and why it matters for the Stanford community.
By combining something you know, such as your SUNet ID password, with something you have, like a mobile device, Stanford Two Factor Authentication significantly reduces the risk of unauthorized access. The following sections detail implementation, configuration options, and best practices.
| Authentication Method | Device Requirement | Push Notification | Typical Use Case |
|---|---|---|---|
| Duo Mobile App | Smartphone or tablet | Yes | Daily login approval |
| Hardware Token | Physical key fob or USB device | No | High-security labs and shared accounts |
| SMS Passcode | Cell phone with text capability | No | Emergency access without app |
| Voice Callback | Any phone | No | Low bandwidth or accessibility needs |
How Duo Integrates With Stanford IT Systems
Stanford has standardized on Duo Security to provide consistent two factor authentication across enterprise applications. IT teams configure Duo to protect Weblogin, SUNet-powered services, and VPN endpoints.
When a user attempts to sign in, the authentication prompt requests a second verification through Duo. The system logs each attempt, enabling audit trails for compliance and incident response.
Enrolling and Managing Devices for Stanford Two Factor Authentication
Adding a New Device
Users can enroll multiple devices, such as a primary smartphone and a backup token, ensuring continuous access even when one device is unavailable.
Updating or Removing Devices
Authorized users can manage their registered devices through the Stanford Identity and Access Management portal, removing lost phones or retired hardware tokens.
Security Policies and Administrative Controls
Stanford security policies require two factor authentication for all privileged administrative actions and remote access to sensitive systems. Exceptions are reviewed and logged.
Departmental IT administrators can define application access policies, specifying which groups require hardware tokens versus mobile app authentication based on risk levels.
Troubleshooting and User Support
Common issues include delayed push notifications, expired device registrations, and SMS delivery failures. The Stanford IT Help Center provides step by step guides and phone support for Duo related problems.
Users traveling abroad should verify roaming settings for cellular and data services, and hardware tokens continue to work without network connectivity.
Best Practices and Key Takeaways for Stanford Two Factor Authentication
- Enroll at least two methods, such as Duo Mobile and a hardware token, to maintain access during device loss.
- Keep your contact information up to date in Cardinal Directory to ensure accurate SMS and voice delivery.
- Review authentication alerts promptly and report suspicious prompts to Stanford IT.
- Follow departmental guidelines when configuring access for shared or laboratory accounts.
- Test your backup authentication options before traveling or during IT maintenance windows.
FAQ
Reader questions
What should I do if my Duo push notification will not arrive?
Check your internet connection, confirm that the Duo Mobile app has notifications enabled, and ensure your device time is set automatically. If the problem persists, use an alternate method such as SMS or a hardware token.
Can I use Stanford Two Factor Authentication without a smartphone?
Yes, you can use a hardware token, SMS passcode, or voice callback as your second factor. Contact Stanford IT to request a hardware token or configure alternative methods in your account settings.
Is my authentication history visible to my department?
Detailed logs are retained by Stanford Information Security for monitoring and forensic purposes. Departmental staff typically see aggregated reports related to access patterns rather than individual authentication events.
How often do I need to re authenticate with Duo on my devices?
Most campus applications require reauthentication after a set period or when you clear browser cache. Duo evaluates device trust based on policies, which may prompt for second factor less frequently on trusted devices.