Hardware Tokens - Purchase and Enrollment

This document provides instructions for purchasing and enrolling individual Duo hardware tokens or departmental bulk orders.

EPCS Providers: If you use two-factor authentication for Electronic Prescription of Controlled Substances (EPCS), work with your unit liaison to get provisioned. Do not purchase Duo hardware tokens from the Computer Showcase or follow the instructions here. 

Before You Begin

• Hardware tokens are sold by the Computer Showcase for $25 each.
• A Duo hardware token needs to be enrolled for an individual before it can be used. You can enroll your hardware token online.
• A new Duo hardware token has a battery life of five years.
• Some units cover the cost of hardware tokens for staff. The decision to cover the cost or not, and under what circumstances, is up to individual university units. If your unit does not cover the cost and you want to have your own hardware token, you can purchase it yourself.
• If you are unsure which two-factor option you want to use, see Two-Factor Authentication Options for more information.

Individual Hardware Tokens

Purchase at the Showcase

To purchase a Duo hardware token, visit the Computer Showcase in person or order online. Refer to the product information for details about the item.

Note: Any individual with a U-M ID may purchase a hardware token. If you want to use a Shortcode for payment, you must be an authorized Shortcode signer for your department. If you are not an authorized signer, you may ask an authorized signer to submit an order online and designate you to handle the pick up. Please see the departmental ordering page for more info.

Enroll Online

Before you can use your hardware token when logging in, you need to enroll it.

1. To enroll your hardware token online, go to the UMICH Account Management website.
2. On the Two-Factor (Duo) tab, click Enroll Hardware Token.
3. On the Hardware Token Enrollment page, in the Token Serial Number box, enter the serial number from the back of your hardware token, then click Enroll.
4. You can immediately test your token by clicking the green Enter a Passcode button. You will then be prompted for the passcode generated by your hardware token.

If you prefer, you can ask the staff at the Computer Showcase to enroll your token for you (a U-M ID card is required to verify identify) when you purchase it, or you can ask the ITS Service Center staff to enroll it for you over the phone (you will be asked to provide information to verify your identity).

Report Lost or Stolen Tokens

If you lose your Duo hardware token or suspect it has been stolen, please report it to the ITS Service Center. Service Center staff will mark that token serial number as missing to prevent others from using it.

Bulk Orders by Departments

Departments may choose to order hardware tokens and distribute them to their staff.

1. Visit the Computer Showcase to purchase the hardware tokens in person or order online. Refer to the Showcase's Duo Security Token information for a product description.
2. After receiving the hardware tokens, get them enrolled using one of these methods:
   • Ask the individuals who will use the tokens to enroll them themselves at UMICH Account Management.
   • Download this Excel spreadsheet template to record the serial number from the back of each hardware token with the uniqname of the individual to whom it will be given. Record the serial number from the back of the token without dashes, and them complete the steps below.

3. Send the spreadsheet to the ITS Service Center to request that the hardware tokens be enrolled with the individuals. The person who submits the request will be contacted to verify their identity.
4. Distribute the hardware tokens to the assigned individuals.

Reassign a Hardware Token

To reassign a hardware token from one person to another, either:

• If the previous owner of the hardware token deleted the hardware token from his or her Two-Factor (Duo) - My Settings & Devices, the new owner can enroll the hardware token online following the instructions above. If the previous owner did not delete the hardware token, the new owner can call the ITS Service Center at 734-764-4357 (4-HELP) to enroll the hardware token.
  OR
• Submit a request to the ITS Service Center with the serial number from the back of the hardware token and the uniqname of the individual to whom it will given. The person who submits the request will be contacted to verify their identity.