Using Duo Passcodes and Offline Access Safely
Using Duo Passcodes and Offline Access Safely
Duo can use several kinds of passcodes, and they are not interchangeable. A Duo Mobile passcode is generated in the app for an activated organization account. A hardware token displays a code. A text message may contain a temporary code. An administrator may issue a bypass code under controlled circumstances. Windows or macOS offline access is a separately activated feature for supported computer logons when the computer cannot contact Duo.
Your organization decides which methods are available. If an option is not shown, do not try to create or obtain it outside the approved process.
Use a Duo Mobile passcode
- Start the login from the organization’s normal application or computer sign-in screen.
- In the Duo prompt, choose Other options, Other methods, or Duo Mobile passcode, depending on the screen.
- Open Duo Mobile and locate the organization’s account. Tap the account or passcode control to display a code.
- Enter the code only into the active Duo prompt, then submit it once.
Duo Mobile can generate passcodes without cellular service or Wi-Fi after the organization account has been activated. This is useful when push delivery is unavailable, but it does not mean every protected application supports offline sign-in. If a generated code fails, check that you selected the correct organization account and that the phone’s date and time are automatic. Do not keep guessing or reuse old codes.
For a hardware token, press its button if required and enter the displayed code in the hardware-token option. If a token code is rejected, wait for a fresh code and try once more. Repeatedly pressing a token or submitting codes can move the token out of sync or trigger a lockout.
Text and bypass codes
A text-message passcode is sent only after you request it through the legitimate prompt. Duo documents that SMS passcodes expire when used. If the message does not arrive, use the prompt’s Send a new passcode option once rather than requesting many messages.
A bypass code is not the same as your phone’s Duo Mobile code. It may be restricted by time, use count, or application. Treat it like a temporary password. Never post it in a ticket or send it back to someone claiming to test it. Zerolimit will never ask you for your password or an MFA code.
Understand offline computer access
Offline access for supported Windows or macOS logon must normally be enabled by the organization and activated while the computer can reach Duo. Activation may use Duo Mobile or a security key, depending on platform and policy. A regular Duo Mobile account does not automatically create a Windows or Mac offline-access account.
When offline access is active, follow the computer’s Duo logon prompt and use the method shown. Duo’s macOS guidance explains that the prompt may display either remaining offline logins or the last allowed day, depending on administrative policy. After the use or time limit is reached, an online Duo authentication is required before offline login works again. Windows offline access is likewise governed by configured limits and can require reactivation after device changes.
Before travel or planned disconnection, connect the computer to the internet and complete a normal Duo login. Confirm offline access only if your organization permits a controlled test. Do not disconnect a production computer merely to experiment. Remember that offline access authenticates a supported local computer logon; it does not make cloud applications available without internet service.
Safe troubleshooting
- Set phone and computer date/time to automatic.
- Make sure you are using the code from the correct Duo Mobile account.
- Avoid deleting duplicate-looking offline accounts after a phone restore; restored offline entries may need formal reactivation.
- If the prompt says the offline limit was reached, reconnect to an approved network and complete online authentication.
- If the phone was replaced, use the approved reactivation process. Duo Restore does not automatically reactivate Windows offline access.
When to stop and contact Zerolimit
Contact Zerolimit if two fresh codes fail, the token appears out of sync, no passcode option is offered, offline access was never activated, the offline limit is exhausted, a replacement phone created duplicate entries, or the account becomes locked. Report the application or computer, code type, approximate time, connectivity state, and exact error, but not the code itself. Never provide your password, passcode, QR code, security-key PIN, recovery secret, or push approval.
Support safety reminder: Zerolimit will never ask you for your password or an MFA code.