The Basics
Two-factor authentication (2FA) helps protect your personal information as well as the College's online resources. It is required for all regular employees (faculty and staff), all Amherst College students, and any person who logs into Workday.
Here's how it works: Every time you log into an Amherst College service such as Workday, email, or Moodle that uses the purple or single-sign on login screen you will be presented with a second window that requires you to provide a second factor before you can log in. Most of the time, this second factor is tied to your mobile or landline phone.
You will be notified via email with the date and time when you will automatically be enrolled in Duo. Then, the very first time you log into a Duo-protected service after enrollment, you will be required to set up a device--usually a smartphone--that you will use to satisfy 2FA requests. See The Enrollment Process below.
If you don't have a cell phone that supports the Duo mobile app, or if you have an issue that may prevent you from temporarily using Duo, please fill out the Duo Accommodation Form.
The Details
The College uses Duo Security for two-factor authentication. 2FA provides additional login security to College web services and also protects you if your account is compromised by a phishing attack. 2FA is mandatory for all current students and current employees, both faculty and staff, and for anyone who logs into Workday. Alums, emeriti/retirees, Five College students, applicants, etc. should not--and in most cases cannot--enroll in Duo.
2FA is used on most Amherst College web-based services, including Moodle, Workday, Gmail and other Google apps, and the Amherst website, and on many Amherst third-party services such as Slate (Admission) and Handshake (Loeb Center). (In tech speak, 2FA is enabled on all college web services that are "shib-enabled;" i.e, the ones that use the purple login screen.) 2FA is not used for computer logins; it only protects logins to services hosted on websites.
How it Works
Once you are enrolled in Duo, you'll see an extra login screen after you enter your Amherst username and password on a protected service. You'll then be promped to take a specific action to complete the login process. The action you take depends upon the devices you activate when you enroll in Duo. These include responding to a "push request" sent to your smartphone, responding to a phone call placed to your office phone or smartphone, or entering an automatically-generated passcode. Once you've satisfied this "second factor," you'll be logged into the service.
Pre-Enrollment Option
Instead of waiting for automatical enrollment, which may be scheduled for a day and time that isn't convenient for you, you can opt to pre-enroll in Duo before you enrollment deadline.
Note that pre-enrollment requires an Amherst ID card. If due to COVID-19 restrictions you haven't been able to go in person to Dining Services to get a card, you can contact ID Services (idservices@amherst.edu) to learn how to order a card that can be mailed to you.
Pre-enrollment isn't available to non-Amherst employees such as Workday consultants and Folger employees.
Pre-enrolling only takes a few minutes. Here's what you will need at hand:
- a computer
- a phone--preferably a smartphone, but any phone will work, including a land line. You can also use an iOS or Android tablet or a USB security key
- your Amherst ID card
Note that if you have an iPhone or iPad, or an Android phone or tablet, it saves time if you install the Duo Mobile app from the Apple or Google store before you begin the enrollment process.
Access the Amherst College Duo Pre-Enrollment Page
Duo works all over the world. It isn't necessary to be on campus to enroll in Duo or to use it for logging in.
If you don't have access to a phone or other device required for 2FA, or for some other reason don't think you can use 2FA, please fill out the Duo Accommodation Form.
The Enrollment Process
If you elect not to pre-enroll, or if you are unable to do so, your account will be enrolled automatically in Duo on the date and time specified in your Duo enrollment email message.
Once your Amherst account is enrolled in Duo you will be required to set up a device to use for 2FA requests. This will happen the next time you log into a Duo-enabled service. After you use your Amherst username and password to log into a Duo-protected service you are presented with the Duo Start Setup button, which leads you through the device-setup process. The following video details the process. Unlike pre-enrollment, setting up a device after you have been automatically enrolled does not require an Amherst ID.
Help with Enrollment
If you have any problems with enrollment or with using Duo, please contact AskIT.
More Information
How to Switch to a New Phone: You've replaced the smartphone that you previously used with Amherst 2FA. Here's how to get your new phone to work with Duo.
How to Enroll a Security Key: A security key is a small USB device that lets you satisfy 2FA requests with the press of a button. No phone required!
Duo Accommodation Form: Let us know about circumstances and concerns that may prevent you from using 2FA. Such circumstances could be temporary or permanent.
Frequently Asked Questions about 2FA at Amherst: Will Duo work while you're abroad? What happens if you forget your phone? Answers to these and many other questions.
What is 2FA?: A video from Duo explaining the rationale behind two-factory authentication.