Traveling with Duo Multi-Factor Authentication (MFA)
Plan Ahead
There are many options to authenticate with Duo MFA and several of them will still function even if you find yourself without cell service or a stable network connection on your travels. However, it's important to consider the conditions you might encounter on your travels that may impact how you authenticate. Planning ahead and understanding whether or not you may need to add devices or change how you authenticate before you board your flight will help ensure you're prepared and able to log in, no matter what.
Try to answer these key questions before traveling and as you continue to read below:
- Which second factor devices will you have access to during your travels?
- Will you have access to a smartphone or tablet?
- Will you have access to a (non-smart) cellphone?
- Will you have access to a landline?
- Do you have a hard token?
- Will you have access to cellular service, mobile data, or WiFi?
- Are you traveling to a country subject to export controls?
Short on time? Check out our quick reference guide: The ABCs of Traveling with Duo MFA.
Select Appropriate MFA Method(s)
It is important to understand which authentication methods will work for you and under what circumstances before you travel. If the device or authentication method that you normally use will not work during your travels, you will need to add a different authentication method ahead of time.
For instructions on adding any of the authentication methods below for use with your Duo MFA, please see our Adding Devices article.
For instructions on how to use any of the below methods to authenticate when logging in, please see our Logging in with MFA article.
If you will have access to a smartphone or tablet:
- OPTION 1: Use the Duo Mobile app to send a push to your smartphone or tablet. Requires mobile data or WiFi.
- OPTION 2: Use the Duo Mobile app to generate a passcode. Does not require mobile data or WiFi, will work even when completely offline.
- OPTION 3: Send yourself a passcode via SMS. Cell service is required to receive the SMS with a passcode, but the passcode can be used even if you subsequently lose reception or service.
- OPTION 4: Receive a phone call to your cellphone. Press '1' when prompted to approve your authentication. Cell service or WiFi calling is required to receive phone calls.
If you will have access to a (non-smart) cellphone:
- OPTION 1: Send yourself a passcode via SMS. Cell service is required to receive the SMS with the passcode, but the passcode can be used even if you subsequently lose reception or service.
- OPTION 2: Receive a phone call to your cellphone. Press '1' when prompted to approve your authentication. Cell service is required to receive phone calls.
If you will have access to a landline:
- OPTION 1: Receive a phone call to your landline. Press '1' when prompted to approve your authentication. Requires telephone service.
If you will have access to a hard token:
- OPTION 1: Plug your hard token into a USB port on your laptop/computer, and press the button on the hard token when prompted to authenticate.
General Recommendations
Use the Duo Mobile app
It is highly recommended to setup and use the Duo Mobile app if you will have access to a smartphone or tablet during your travels. The Duo Mobile app allows you to authenticate via push notifications if you have access to mobile data or WiFi. The Duo Mobile app also allows you to generate and use passcodes even if you find yourself completely offline!
Add multiple devices
It is recommended to add an additional device. Should your primary authentication device be lost or stolen, you may find yourself unable to login.
Traveling to Export Controlled Countries?
The following countries and regions are under sanctions by the U.S. Office of Foreign Assets Control (OFAC) and all Duo authentication methods (Duo Mobile, Duo passcodes and SMS passcodes, phone calls, and hard tokens) will not function as they are blocked within their borders.
- Cuba (CU)
- North Korea - Democratic People's Republic of Korea (KP)
- Iran (IR)
- Sudan (SD)
- Syria (SY)
- Crimea region (43)
- Donetsk region (14)
- Luhansk region (09)
- Sevastopol region (40)
Please contact the ITS Help Desk if you are planning to travel to any these countries or regions. If you are traveling to these countries or regions, you are required to uninstall the Duo Mobile app from any devices you will be taking with you and are prohibited from traveling with hard tokens. All authentications from these embargoed destinations will result in an "Access denied. Duo Security does not provide services in your current location." message.
Trouble Logging in When Traveling?
If you're having any difficulty logging in when traveling, please contact the ITS Help Desk. Support available 24x7.
