Multifactor Authentication — Duo

Use multifactor authentication to protect systems with valuable data...as well as your account.

Phone call and text message verification are being retired

Phone call and text message verification will stop working for faculty and staff in November 2026, and for students, alumni and all other accounts in January 2027.

We will email you with the exact date for your account. Setting up a replacement takes about five minutes — see Phone call and text message retirement below.

Related Information

MFA installation and troubleshooting FAQ
Duo MFA for Windows RDP
Duo MFA for Unix logins
Identity and Access Management services available to Columbia groups
Identity Enrollment and Management at Columbia

Also known as MFA, two-factor authentication, TFA, Duo and two-step verification.

On this page:

 

About MFA

Multifactor authentication (MFA) uses multiple proofs of identity to ensure you are authorized to access the service or resource that you are requesting.

These proofs include more than one of:

  • something you know (a secret piece of information, such as a password)
  • something you have (a token, card or device)
  • something you are (a biometric measurement or representation)

CUIT uses Duo as the MFA service to verify your identity for Columbia’s centralized applications. With Duo, you can use the Duo Mobile app, the fingerprint or face recognition built into your computer, a security key, or a hardware token. Duo can be combined with other authentication factors like username and password authentication to create multifactor authentication. Most people use Duo via the mobile app, Duo Mobile, which runs on a variety of smartphones and tablets.

Duo multifactor authentication is required for logins to all CAS-protected services, including Columbia Health, View Your Paycheck, Courseworks and many others, as well as the Columbia VPN, Remote Desktop to CUIT-managed Windows servers, and CUIT-managed Linux hosts including cunix.

Your verification options

Any one of these methods is enough. You can enroll in more than one, and we recommend it — a second method means you are not locked out if you lose your phone or leave it at home.

If you already use one of the methods above as well as phone or text, phone and text will stop appearing as options for you from Thursday, November 5, 2026. There is nothing you need to do.

If you choose the Duo Mobile app, turn on backup at the same time so it moves with you to your next phone — see Switching to a new phone.

Phone call and text message retirement

Why this is changing

Phone calls and text messages are the weakest verification methods available, and attackers target them deliberately. A phone number can be moved to a device someone else controls, and text messages can be intercepted without your carrier account ever being touched. An attacker who already has your password can also simply call you repeatedly until you approve a login you did not start.

Columbia accounts have been compromised this way. Once inside, attackers redirect pay and refund deposits, open personal and academic records, and use the account to send convincing phishing messages to other members of the community. Every other method on this page blocks this. Phone and text do not.

When it happens

What happens if you do nothing

If phone or text is still your only verification method on your date, you will not be able to sign in to Columbia systems — including Lionmail, Courseworks, View Your Paycheck, SSOL, library resources and the VPN — until you set up a different method. Setting one up takes about five minutes, and you only have to do it once.

DUO MFA Setup

Click here to set up or test Duo MFA if:

  • You don’t have a Duo account and want to set one up now. (It requires a UNI and takes about 3 minutes.)
  • You’ve already set up Duo and want to test it.
  • You want to add a new verification method, or change which one you use by default.
  • You currently verify by phone call or text message and need to replace it before your date.

 

Account Recovery Email

An Account Recovery Email is a non-Columbia email account that can be used to verify your identity by sending you a one-time code. It is not a replacement for a verification method, but it makes it much easier to get back in if you change, lose or misplace your device.

If you are switching away from phone or text verification, set this up at the same time. Go to Manage My UNI and select Add or Update My Account Recovery Email.

Switching to a new phone

If you use the Duo Mobile app, turn on backup now — before you replace your phone. With backup on, Duo Mobile moves to your new device in about a minute. Without it, you will need to contact the Service Desk to re-enroll, or reset your Duo account using Manage My Duo.

On iPhone: back up your phone to iCloud and make sure iCloud Keychain is turned on (Settings → your name → iCloud → Passwords). Duo Mobile is included in your nightly iCloud backup automatically. When you set up your new iPhone, restore it from that iCloud backup and Duo Mobile reconnects on its own.

On Android: open Duo Mobile, go to Settings, and turn on the backup option — labeled Duo Restore or Back up accounts, depending on your version. Your phone needs a screen lock (PIN, pattern or password). On your new phone, install Duo Mobile and tap Get My Account Back.

Check these before you switch:

  • Both phones must run the same operating system. Moving from iPhone to Android, or Android to iPhone, will not restore your accounts — you will need to re-enroll from scratch.
  • Duo Mobile must be version 3.33.0 or later on iPhone, or 3.32.0 or later on Android.
  • Restoring on the new phone turns Duo off on the old one. That is expected.
  • If you also keep non-Columbia accounts in Duo Mobile (Google, GitHub and similar), Duo will ask you to create a separate recovery password to back those up. Save it somewhere safe — if you lose it, those accounts cannot be recovered. It does not affect your Columbia account.

Already replaced your phone and can’t sign in? See Account Recovery Email above, or contact the CUIT Service Desk.

Duo MFA Information for Alumni

Duo MFA is required for all logins to CAS-protected services by alumni. This includes logins to most Columbia online resources like transcript requests, library access and Lionmail. Duo MFA is also required for logins to CUIT-managed Linux hosts including cunix.

Alumni accounts are included in the January 2027 group. If you currently verify by phone call or text message, please set up one of the options in Your verification options before then. If you do not have a smartphone, the CUIT Service Desk can issue a hardware token instead, and your first one is free.

For help with your UNI, go to the Columbia Alumni website. For questions about why this is required, contact the Columbia Alumni Center at 212-851-7800 or [email protected].

If none of the options work for you

Nobody will be locked out for lack of a device. If you cannot use any of the methods above, contact the CUIT Service Desk before your exception deadline and we will find an option that fits your situation.

  • Your first hardware token is free. If you do not have a smartphone, or would rather not use a personal device, CUIT will issue one at no charge. If the battery runs down, bring it back and we will replace it free. Replacing a lost token costs $30.
  • Accommodations for disability-related needs are approved on request and are arranged in coordination with the Office of Disability Services. There is no charge to replace a token issued as an accommodation.
  • If you work on a shared or clinical workstation, ask about a security key rather than an individual exception.

Approved exceptions are temporary. All exceptions expire on Thursday, January 28, 2027, after which phone and text stop working for those accounts as well.

Please allow one business day for a reply, and contact us well before the deadline rather than on it.

FAQ 

You can find detailed FAQs for installation, troubleshooting, Windows RDP and Unix on our expanded MFA FAQ page. 

Authentication is the process of ensuring that something is genuine. Username and password authentication uses a shared secret (the password) to establish that a user of an application is actually who or what the user claims to be.

Multifactor authentication (MFA) uses multiple forms, or factors, of proof, including:

  • Something you know (a secret like a password)
  • Something you have (a token, card or device)
  • Something you are (a biometric measurement or representation)

The number and independence of the authentication factors add to the degree of confidence we have in the identity of the person or thing. This degree of confidence is sometimes called the level of assurance. A multifactor authentication is said to have a higher level of assurance than an authentication that uses a single factor.

Duo is a service that can use a mobile app, a token, or a phone call to authenticate you. It can be combined with other authentication factors like username and password authentication to create multifactor authentication. Most people use Duo via the mobile app, Duo Mobile, which runs on a variety of smartphones and tablets. Here are descriptions and screenshots of Duo Mobile for Android and Apple iOS.

Duo uses your phone to verify your identity.  When combined with a UNI and password, it becomes a very strong form of identity verification.  These instructions describe how to set up Duo on your phone.  Here are instructions for using Duo when you log in. 

Because those two methods can be defeated without ever touching your Columbia account. A phone number can be moved to another device, text messages can be intercepted in transit, and an attacker who has your password can call you repeatedly until you approve a login by mistake. See Phone call and text message retirement.

Contact the CUIT Service Desk and we will issue a hardware token — a small keyfob that displays a code. It needs no phone, app or network connection, and your first one is free. You can also use the fingerprint or face recognition built into your Columbia computer, if it has one.

Your first token is free. Tokens run on a battery that lasts several years. If yours stops working, bring it to the Service Desk and we will replace it at no charge.

If you lose your token, a replacement costs $30. Returning the old one is how we tell a dead battery from a lost token — bring it back and the replacement is free.

How to pay for a replacement

  • Faculty and staff — we charge your department’s chartstring. Please have it with you when you request the replacement.
  • Students — the charge is applied to your student account.
  • Alumni and all other accounts — pay by card at the Service Desk.

Turn on Duo Mobile backup before you make the switch — see Switching to a new phone. If backup is on, your Columbia account moves across automatically on iPhone, or with a couple of taps on Android. If you have already switched without it, contact the CUIT Service Desk.

Yes. If you set up an Account Recovery Email, you can use it to verify your identity and re-enroll Duo Mobile yourself. If you did not, contact the CUIT Service Desk — submit a ticket, email [email protected] or call 212-854-1919. 

You'll be prompted to sign up for a Duo account when you log into a Columbia University resource that requires it.  If you want to get that out of the way in advance, you can set up Duo now by logging in with your UNI and password to the Duo Setup and following the on-screen instructions.  For a fuller description of the setup steps, see How do I use Duo for the first time?

 

No, just continue using Duo MFA as you have in the past.  If you haven't used the Duo Mobile app in over 30 days, you may have to reactivate the app.  See these instructions for reactivating Duo Mobile.

An Account Recovery Email is a non-Columbia email account that can be used to verify your identity by sending you a one-time code. Once you’ve set up Duo, we strongly encourage you to set up an Account Recovery Email, which will make it easy to continue using Duo if you change, lose or misplace your phone. Go to Manage My UNI and select Add or Update My Account Recovery Email.
 

Your Columbia account and the services you log into are valuable assets to you and Columbia University. Unfortunately, passwords have become vulnerable to theft and are no longer considered good enough to protect these assets. A stolen password can lead to your email being hijacked by an attacker.  This in turn could give them access to reset your password on other personal accounts, like a PayPal or bank account. A password plus an additional authentication method like Duo MFA is much harder to steal and provides much better protection. As a result, Columbia, along with many financial, research, and governmental organizations, now requires MFA for access to valuable organizational assets.

Duo has been added to Columbia's CAS authentication service to create multifactor authentication for web browser-based applications. It is required for all CAS logins. Duo authentication has also been added to Remote Desktop Protocol (RDP) logins for CUIT-managed Windows servers, logins to CUIT-managed Linux hosts including cunix, VPN logins, and logins to various other services. 

For operational and technical questions about Duo, please submit a ticket to the CUIT Service Desk, email [email protected] or call 212-854-1919. For policy questions ("Why must I do this?") please contact the Columbia Alumni Center, 212-851-7800 or email [email protected].