Changes to Duo Multi-Factor Authentication Prompt

UCLA utilizes Duo Security as our vendor for Multi-Factor Authentication (MFA) integration, and the company has announced an updated version of the MFA prompt named “Universal Prompt.” To address a critical security vulnerability, UCLA needs to convert to Universal Prompt on Tuesday, May 24, 2022.

You may notice the following when logging in and utilizing the new MFA prompt:

• The look and feel of Universal Prompt will be different but it will support the same features (please see images below and on the Changes to the DUO Prompt page)

                   

        Old Prompt                                      |                 New Prompt

Other Details:

• The URL in the web address bar on your browser will start with "https://shb.ais.ucla.edu" on the page requesting your username and password, but will switch to a URL similar to "https://api-xxxxxxxx.duosecurity.com"

• The MFA prompt will automatically perform the most secure method of authorizing your logon (e.g. Duo push) when the Universal Prompt is first used.

• • Duo authentication methods from most to least secure:

    1. Touch ID
    2. Security keys
    3. Duo Mobile push approval
    4. YubiKey passcodes
    5. Duo Mobile generated passcodes
    6. Hardware token passcodes
    7. SMS passcodes
    8. Phone call approval

• The MFA prompt will automatically perform the last utilized authorization method on subsequent logins (so you prefer to use the phone method, that will be the default next time)

• To change MFA device options there will be an “Other Options” link at the bottom of the prompt

• “Remember me for 12 hours” has been renamed to “Trust this browser?” which will be displayed on a separate screen and does not state the amount of time for which the browser will be trusted

Please visit the Office of the Chief Information Security Officer website to see the updated look and feel. While these adjustments may take some getting used to, they will streamline the authentication process while improving the security accessibility of the tool. Thank you for your attention to these changes.