Changes to Two-Step Verification Coming November 2023

Announcement Date
Friday, October 20, 2023 - 9:48

As part of Penn’s Identity & Access Management (IAM) Program, improvements to the Two-Step Verification user experience are coming on November 14, 2023 with the release of Duo Universal Prompt. Duo Universal Prompt is a vendor-supplied Multi-Factor Authentication (MFA) application that will replace Penn’s current custom Two-Step service for PennKey authentication. PennKey will integrate directly with Duo for a seamless user experience. Duo Universal Prompt provides a modern, secure, easy-to-use login interface and a simpler way to add and manage devices.

Who Is Affected?

All PennKey Two-Step Verification users and PennKey support providers will be affected by the changes.

What Will Change?

Current PennKey Two-Step users do not have to re-download the Duo Mobile app or take any actions prior to rollout, but the following changes will occur upon rollout:

  • Users will see the new Duo Universal Prompt UI instead of the current Penn custom interface during PennKey WebLogin:
    • Users will see the new Duo Universal Prompt UI instead of the current Penn custom interface during PennKey WebLogin
  • All existing “Trust this browser” sessions will expire.
    • All users will need to authenticate with Two-Step upon their first login after rollout.
    • Duo Universal Prompt will enforce a 60-day limit on trusted browsers.
  • The following legacy Two-Step functions will be retired:
    • “Generate Codes” – Replaced by code generating function within Duo Mobile app or Duo fob.
    • User dashboard (enroll, manage settings, trouble logging in) – Replaced by Duo Universal Prompt.
    • New Google Authenticator registrations – Replaced by Duo Mobile app.
      • Existing Google Authenticator registrations will continue to work.
    • New SafeID fobs will no longer be distributed on campus – Replaced by Duo fobs and hardware security keys.
      • Existing SafeID fobs will continue to work.
    • “Help a Friend” – Method no longer supported.

Policy Change Note: New PennKey recipients will have 30 days to register for Two-Step Verification. If they do not complete the process in time, they will require assistance from a PennKey administrator.

More Information

For any questions, please reach out to ithelp@design.upenn.edu.