Two-Factor Authentication (2FA)

Two-factor authentication provides an extra layer of protection for your UMPASS account, and it aims to ensure that you are the only person accessing your account.

Two-Factor authentication ensures secure access to the protected systems as simple as the following steps.

Step 1	Step 2	Step 3
Enter username and password as usual. (First Factor)	Use your mobile device/ tablet to verify your identity. (Second Factor)	Securely logged in

Scope of service

2FA will be used  when you access the protected systems with non-UM network (e.g. outside campus).

Benefits of Two-Factor Authentication

• Ensure account security: Compared to the traditional login process by using username and password, 2FA provides an additional form of validation. It works together with your personal device to lower the possibility of identity theft by attacker.
• Ensure data security: By adding an additional layer of authentication, it can minimize the risk of account theft, and thus, protecting the University’s as well as your personal data.

Systems that are protected by 2FA

All systems that use the UMPASS authentication service as the login page are in effect with the 2FA.

If you are interested to use the 2FA service, please follow the following steps to apply: 

1. Download the “Duo Mobile” app for your mobile device.
2. Make sure that you are using intranet when you apply for 2FA service.
3. Login to ICTO Account Information Page to apply the 2FA service. By agreeing the terms and conditions, you will be redirected to the UM 2FA User Device Registration (https://account.icto.umac.mo/#twoFArule) for account activation. You need to complete the on-screen instructions until device registration is finished.
4. You can refer to “2FA Service User Guide” below to register more than one device after account activation.
   *We recommend you to register two devices for backup purpose. It can save your time in case you change or accidentally lose one registered device. 

Please refer to 2FA User Application Procedures for details.

When your mobile device does not support Duo Mobile APP, you may borrow a DUO hardware token from ICTO. Please bring your UM staff/student ID card and your mobile phone to ICTO Help Desk for required procedure.

*DUO currently supports for iOS and Android, and does not support non-standard customization (such as OnePlus, LineageOS or ColorOS) and other platforms (such as Hongmeng, HyperOS, etc.), users are advised to check with the manufacturer before purchasing a mobile device.

We support:

• “Push” Response
• Passcode (one-time)
• Hardware Token

We don’t support:

• Phone call
• Text Message

What if I don’t have my phone on me?

If you lost your device or forget to bring device, you can ask for a bypass code for emergency login. A bypass code can help you to bypass 2FA authentication when you have difficulty to use your device to login. (Please refer to 2FA Changed & Lost Device Guide for details.)

We will provide you a bypass code:

• If you have lost your device and only registered this device.
• If you removed the DUO mobile app from a uniquely registered device.
• If you forget to bring your device and need to login to the application urgently.

*We recommend you to register two devices for backup purpose. It can save your time when you change or lost one registered device.

To get the bypass code, you can either:

1. Go to ICTO Help Desk with your UM ID card to ask for a bypass code.
   Or
2. Send an email with your staff/student ID, the first four numbers of your identity card and your justification for getting the bypass code.

Types of bypass code

We provide two kinds of bypass code according to following situations:

We provide two ways for your self-service to manage your device and their appearances and steps are identical.

• When you are inside campus, you can go to our UM 2FA Self-Service Page (https://2fa.um.edu.mo).

• When you are using non-UM network (outside campus), you could login to the protected system directly to manage your device.

• 2FA User Application Procedure
• 2FA Service User Guide
• 2FA Changed & Lost Device Guide
• 2FA Hardware Token User Guide

• 2FA Introduction Video
• Is it necessary to input my phone number during 2FA registration?
• What kind of device can be registered for 2FA service?
• What is the difference between “Mobile” and “Tablet” during 2FA registration?
• How many devices can be enrolled for 2FA service?
• Can I opt-out DUO after my 2FA account activation?
• What should I do if I change my 2FA registered phone?
• What should I do if I lost my 2FA registered phone?
• What should I do if I plan to travel oversea and want to use 2FA service?
• What should I do if I cannot access Google Play Store in China for 2FA service?
• What should I do if I receive any unexpected 2FA notification?
• What should I do if I cannot receive Duo’s Push notification of 2FA service?
• What is the “remember me” in 2FA?
• How do I remember 2FA login credential for 15 days in my devices?
• What prevent 2FA “remember me” from working correctly?
• Why Safari browsers does not work for 2FA Remember My Device for 15 days?
• How do I reset 2FA “remember me” on a browser when I no longer use?
• How long does “remember me” option in 2FA last?
• Can Duo’s “remember me” feature work if third-party cookies are blocked?