Re: [EXTERNAL] Re: [SECURITY] [External] [SECURITY] Duo/2FA exemption policies

[Gene LeDuc <gleduc () SDSU EDU>]

We've found it easier to delete the old/lost phone from the user's Duo 
account instead of doing a temp disable.  It seems cleaner and doesn't 
bypass MFA (other than Duo's).  If the Duo account doesn't have any 
devices, then the user logs in with credentials and gets to register a 
new device, problem solved and no temp bypasses to undo.

Gene

On 8/14/19 6:14 AM, Gregg, Christopher S. wrote:
> We also have a process in place to allow the help desk to temporarily 
> disable MFA for people who are in the process of replacing a lost/broken 
> phone, but I assume you are looking for ongoing/long-term exceptions.

--
Gene LeDuc                 | Don't cling to a mistake just because you
Technology Security        | spent a lot of time making it.
San Diego State University |

**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community