Skip to main content

Cornell University

IT@Cornell

Two-Step Login Setup Guide

Detailed instructions on how to set up Two-Step Login. For a shorter version of these instructions, see Get Started with Two-Step Login.

This article applies to: Two-Step Login

During Fall 2025, Cornell is retiring the Duo Phone Call and Duo SMS Passcode methods. Affected campus populations will be notified by direct email about when this change will affect their accounts. To learn more, visit Important Two-Step Login (Duo) Changes, Starting August 2025.

This page will guide you through steps for setting up your devices in Two-Step Login.

You can:

  • Install and register the Duo Mobile app on a smartphone or tablet.
  • Enroll a hardware token, a small device you carry on your keychain. You can purchase hardware tokens online or in person at The Cornell Store.
  • Enroll a Security Key, a USB-based device that plugs into a USB port on your computer and only works with Chrome or Firefox. You can purchase a security key online.
  • Enroll Touch ID to use a fingerprint reader with MacOS and Chrome. Learn more about Using Apple Touch ID with Duo.

Set Up Devices

  1. Sign in at Manage Your Two-Step Login with your NetID and password.
  2. Select Start Enrolling Devices Now. For instructions on enrolling and using a hardware token, see Hardware Tokens for Two-Step Login.

    Manage Your Two-Step Login webpage showing button titled Start Enrolling Devices Now
  3. At the Duo welcome screen, click Next. ("Duo" is the name of the IT security service supporting the Two-Step Login service.)


     
  4. Duo will provide additional information about online security on the next couple of screens. Read this important information and click Next to advance at each screen.


     

  5. When you reach the Select an option screen, select the primary authentication method you would like to enroll. 

    It is recommended that you use the Duo Mobile app with Cornell’s Two-Step Login. Duo Mobile supports mobile app, phone call, and SMS text message authentication.

    Duo Select an Option screen showing Touch ID, Duo Mobile, and Security Key options for setup, with Duo Mobile highlighted.


    Choose an authentication method, then skip to the section in the instructions below for configuring that option.

After you finish enrolling your first device, Duo will ask you to add additional methods. 

Your additional method can be a USB security key, hardware token, or macOS Touch ID. (While the Touch ID option is available for users who own a macOS device that supports it, Cornell strongly recommends the Duo Mobile option for a primary authentication method.)

Duo Mobile

After selecting Duo Mobile on the Select an option screen:

  1. Type your mobile device's phone number at the Enter your phone number screen. (If you are enrolling a tablet with no phone number, click I have a tablet.)

     
     
  2. Confirm you have typed the correct number by clicking Yes, it's correct when prompted. If you mistyped or entered an incorrect number, click No, I need to change it and repeat the process.

     
If the phone number has already been enrolled in Two-Step Login then you will be required to confirm you physically have the device by having a passcode sent to it, before you can proceed.
  1. Next, Duo will ask you to download and install the Duo app on the mobile device that you are enrolling.

    You can do this by going to the App Store on an iOS device or the Google Play store on an Android device.

    Search for "Duo Mobile," published by Duo Security LLC. Install the app on your device, then return to the browser prompt and click Next.

     
  2. A QR code appears on the Duo enrollment screen. Use the Duo Mobile app on your mobile device to scan the QR code and connect the app to your Two-Step Login account.

If, for some reason, you are unable to scan the QR code, you can instead send the activation code to yourself by email. To do this, click Get an activation link instead.

Follow the instructions in the email to connect your Duo Mobile app to Two-Step Login.
  1. Duo will confirm that your Duo Mobile app has been added. Click Continue.

Security Key

A security key is a small device that plugs into a USB port on your computer. When you are prompted to authenticate with Two-Step Login, you will tap a button on the security key to confirm your login. To use this option, you must :

If you have met those requirements, select Security key on the Select an option screen, then:

  1. Make sure your security key is inserted into a USB port on your computer, then click Continue.

     
  2. When you see the Use your security key with duosecurity.com screen, press or tap the button on your USB security key.

     
     
  3. After your USB security key has been added to Two-Step Login, click Continue.

Touch ID

To use this method, you must have:

  • A Mac device with a Touch ID button.
  • Your fingerprint enrolled in the Apple Touch ID program.
  • Chrome version 70 or later. (Safari and other browsers are not supported for this authentication method.)

If you meet these requirements, then select Duo Mobile on the Select an option screen, and:

  1. Click Continue on the Touch ID information screen.

     
  2. Verify your identity in the Duo enrollment prompt using Touch ID or your password.

     
     
  3. Place your finger on the Touch ID button in the Touch bar on your Mac computer.

     
    ​​​​​​​
  4. When Duo confirms that your Touch ID method has been enrolled in Two-Step Login, click Continue.

 

Cornell employees (faculty and staff) can add even more security by switching to a passkey with Secure Connect. With this method, you won’t need to submit your NetID and password, or use Duo, to log in to most Cornell services. Take five minutes and set yourself up with one-touch login.

If you switch to Secure Connect, keep in mind that Duo Mobile Push, USB security key, or hardware token methods must still be available as a backup, even if you use Secure Connect regularly.

Comments?

To share feedback about this page or request support, log in with your NetID

At Cornell we value your privacy. To view
our university's privacy practices, including
information use and third parties, visit University Privacy.