How to Enroll in Duo MFA for the First Time
How to Enroll in Duo MFA for the First Time
Duo enrollment connects an approved verification method to your work account. The exact screens and available methods depend on your organization’s policy, so your prompt may not show every option described here. Use only an enrollment link or sign-in page you expected, and begin from your organization’s normal application or portal. Do not use a QR code or activation link sent unexpectedly.
Before you begin
- Have the phone or other authenticator you plan to enroll with you.
- For Duo Mobile, install the current Duo Mobile app from the Apple App Store or Google Play. Confirm the publisher is Duo Security LLC.
- Use a supported, current browser and a stable internet connection.
- If possible, perform enrollment on a computer while keeping your phone available to scan the QR code.
- Never send anyone your password, a Duo passcode, a screenshot of an activation QR code, or an approval from Duo Push. Zerolimit will not ask you to disclose these items.
Enroll with the Duo Universal Prompt
- Sign in to the protected application through its normal address. Enter your password only on the legitimate organization sign-in page.
- When Duo displays the first-time setup prompt, select Get started or the equivalent button.
- Choose one of the verification methods offered. Duo recommends phishing-resistant methods such as a platform authenticator or security key when your organization makes them available. Duo Mobile is also commonly offered.
- If you choose Duo Mobile, enter or confirm the requested phone information if prompted. On your phone, install and open Duo Mobile.
- In Duo Mobile, choose the option to set up an account with a QR code. Allow camera access when requested, then scan the activation QR code displayed in your browser. Treat this QR code like a secret: do not photograph, email, or share it.
- Follow the on-screen verification test. Depending on policy, Duo may send a push request or ask you to confirm another method.
- If Duo offers a backup method, add one that you can keep secure and access independently. A second permitted device or a security key can reduce the chance of being locked out.
- Finish the prompt and continue to the application.
The labels can vary slightly. If the prompt does not offer device enrollment, your administrator may need to start enrollment or your organization may have disabled self-service.
Check that enrollment worked
Sign out of the protected application and sign in again through the normal page. Confirm that the prompt identifies the method you just enrolled. For a push, read the application and location information and approve only if it matches the login you initiated. For a passcode, generate it locally in Duo Mobile and enter it only into the active Duo prompt. Do not perform repeated tests if the result is unclear; repeated failures can trigger a lockout.
Safe troubleshooting
- The QR code will not scan: Increase screen brightness, clean the phone camera, hold the phone steady, and ensure the entire code is visible. Do not scan a code from an email or unrelated website.
- The code expired: Return to the live enrollment prompt and request a fresh activation flow. Do not reuse an old screenshot.
- Duo Mobile lacks camera access: Enable camera permission temporarily in the phone’s settings, scan the code, and review permissions afterward.
- The account already appears in Duo Mobile: Do not delete it just to retry. Deleting an account from the app can remove your working authentication method. Stop and ask for help.
- A method is missing: Available methods are controlled by policy. Do not try to bypass the policy with another person’s phone or account.
When to stop and contact Zerolimit
Contact Zerolimit if the enrollment prompt says you are not authorized, setup loops or repeatedly fails, you cannot verify with any offered method, the activation code was exposed, or the request appeared unexpectedly. Also stop if the application name, organization, URL, or location looks wrong. Provide your name, the application you were trying to access, the approximate time, and the exact error text. You may include a screenshot after hiding QR codes and passcodes. Never include your password, a Duo code, an activation QR code, or approve a push for support.
Support safety reminder: Zerolimit will never ask you for your password or an MFA code.