Instructions and tips for turning on (or off) two-factor authentication to protect your personal information in the services you log into via the Weblogin page (Wolverine Access, Canvas, U-M Google, U-M Box, MFile, MPrint, and more).
First Enroll in Duo
- You need to enroll a device or phone number before you turn on two-factor. If you have not already enrolled in Duo options, refer to:
- We recommend you enroll both a primary and backup method for two-factor authentication. You can enroll multiple phone numbers and download the Duo Mobile app on multiple devices.
Turn on Two-Factor
You can turn on (or off) two-factor for Weblogin at UMICH Account Management under the Two-Factor (Duo) tab. Those of you at the U-M Health System can also turn it on via your UMHS Profile page.
The following instructions are specifically for the UMICH Account Management page. For best results, use either the Chrome or Firefox web browser. If you use Internet Explorer (IE) 11, turn off Compatibility View.
- From a desktop or laptop computer, go to UMICH Account Management.
- Click Log in in the upper-right corner of the page.
- Log in with your uniqname and UMICH (Level-1) password.
- Click the Two-Factor (Duo) link or tab.
- Click Turn on Two Factor.
- If you have not yet enrolled in Duo, click the green Start setup button. See First Enroll in Duo above.
- Once you have enrolled in Duo, complete one of the Duo prompts, depending on the device or phone you enrolled (for example, Send Me a Push, Call Me, or Enter a Passcode).
- Click the Protect My Account toggle to change it to ON.
- Click Done.
- If you decide you want to turn off two-factor for Weblogin, repeat the steps in this document and change the Protect My Account toggle to change to OFF.
What to Expect
Same Number of Logins
- The number of times you are prompted to log in to websites via the Weblogin page will not change after you turn on two-factor with Weblogin. It will simply add a second step log in—completing a two-factor authentication prompt.
- If you generally work in a single web browser and keep Google Mail open throughout the day, you can expect to log in and complete the two-factor prompt about twice per day.
- If you use multiple browsers or private/incognito sessions, you will need to log in and complete the two-factor prompt for each new browser session.
- If you change location throughout the day, you will be prompted to log in or reauthenticate with each new browser session.
Reauthentication and Time-Out Periods
You only need to complete two-factor authentication when you log in through the Weblogin page. Depending on the services and websites you use, you may be prompted to log in again.
- Adding two-factor for Weblogin does not increase the number of times you are prompted to log in; it adds a second step to the login process.
- Different services and websites prompt you to log in again after different time-out periods.
With U-M Google, there is essentially no time-out. If you are logged into your U-M Google Mail or Calendar all day, you may not need to re-authenticate as you access other systems.
If you use multiple browsers, change location (and therefore the network you are on), or log out of services and websites when you are done using them, the number of times you need to log in and use two-factor increases.
Some of the common time-out periods are listed below.
- Wolverine Access:
- Employee Self-Service: 30 minutes
- University Business: 60 minutes
- Faculty Business: 60 minutes
- Canvas: 60 minutes
- Weblogin: 120 minutes
- U-M Box: 48 hours
Tips
Add Backup Phones or Devices
It is not uncommon to forget your cell phone when you come to work. If you only have one phone enrolled in Duo, you can contact the ITS Service Center to get a two-factor bypass code to use for the day.
If you add your desk phone or a tablet as a backups, you could use them as an alternative until you have your primary device. You can enroll as many phone numbers or devices as you want. See Getting Started: How to Enroll in Duo for the enrollment procedures.
Lock Your Screen Instead of Logging Out
If you do not share your workstation with others during your work shift, you may lock your screen when you take a break. This allows you to remain logged into systems while your computer is secured.
To lock your screen, press Ctrl+Alt+Del on a Windows computer. On a Mac, you will need to set your computer to require a password after sleep or after the screen saver begins (System Preferences --> Security & Privacy --> General tab). Then you can lock the screen by putting your computer to sleep or activating the screen saver.
You will need to log in to your computer to unlock it.
You do not need to completely log out of administrative systems if you are going to work in the systems throughout the day and you lock your screen when you are away from your computer.
It's best to set all your devices—smartphone, tablet, computer—to lock the screen and require a password or passcode for access after 15 or fewer minutes of inactivity. To learn about this and other settings to secure your devices, see Instructions for Securing Your Devices and Data.
Working Across Campus
If you are someone on the move, you probably will want to use your smartphone (or basic cell phone) as your primary two-factor authentication device so you have it when you need it. Of course, you have to remember to carry it with you! If you primarily use your desk phone for Duo, you might want to add your cell phone as a backup to use when you’re out and about on campus.
Access From Home
Duo two-factor authentication is not restricted to U-M devices, phones or computers. If you work from home, or need to access personal information at home (for example, W-2s, paychecks), you can add your home phone number as a backup.