Changes to Two-Step Verification Coming November 14, 2023

As part of Penn’s Identity & Access Management (IAM) Program, improvements to the Two-Step Verification user experience are coming on November 14, 2023 with the release of Duo Universal Prompt. Duo Universal Prompt is a vendor-supplied Multi-Factor Authentication (MFA) application that will replace Penn’s current custom Two-Step service for PennKey authentication. PennKey will integrate directly with Duo for a seamless user experience. Duo Universal Prompt provides a modern, secure, easy-to-use login interface and a simpler way to add and manage devices. 

Who Is Affected? 

All PennKey Two-Step Verification users and PennKey support providers will be affected by the changes.  

What Will Change?  

Current PennKey Two-Step users do not have to re-download the Duo Mobile app or take any actions prior to rollout, but the following changes will occur upon rollout: 

• Users will see the new Duo Universal Prompt UI instead of the current Penn custom interface during PennKey WebLogin:  

• All existing “Trust this browser” sessions will expire.  
  • All users will need to authenticate with Two-Step upon their first login after rollout. 
  • Duo Universal Prompt will enforce a 60-day limit on trusted browsers.  

• The following legacy Two-Step functions will be retired: 
  • “Generate Codes” – Replaced by code generating function within Duo Mobile app or Duo fob. 
  • User dashboard (enroll, manage settings, trouble logging in) – Replaced by Duo Universal Prompt.  
  • New Google Authenticator registrations – Replaced by Duo Mobile app. 
    • Existing Google Authenticator registrations will continue to work. 
  • New SafeID fobs will no longer be distributed on campus – Replaced by Duo fobs and hardware security keys.  
    • Existing SafeID fobs will continue to work. 
  • “Help a Friend” – Method no longer supported.  
  • For PennKey support providers: Two-Step Admin Console – Replaced by new PennKey support application/Penn Community. 
    • Training sessions on how to use the new Two-Step support tools will be scheduled for support providers. Information will be provided as these sessions are scheduled. 

Policy Change Note: New PennKey recipients will have 30 days to register for Two-Step Verification. If they do not complete the process in time, they will require assistance from a PennKey administrator.  

More Information 

• Duo Universal Prompt project details 
• Two-Step Verification website 
• Penn’s Identity & Access Management Program website