Using Duo as a multi-factor authentication (MFA) method¶
This topic provides general information about using Duo in conjunction with multi-factor authentication (MFA), including administrative tasks that must be completed before users can use Duo as an MFA method. If you are a user who wants to set up Duo as your second factor of authentication, see Configuring a second factor of authentication.
Users don’t need to separately sign up with Duo or perform any tasks, other than installing the Duo Mobile application, which is supported on multiple smartphone platforms. For more information about supported platforms/devices and how Duo multi-factor authentication works, see the Duo User Guide .
Prerequisite¶
The Duo application service communicates through TCP port 443.
To ensure consistent behavior, update your firewall settings to include the Duo application service on TCP port 443.
*.duosecurity.com:443
For more information, see the Duo documentation.
MFA login flow¶
The following diagram illustrates the overall login flow for a user enrolled in MFA, regardless of the interface used to connect:
Switching phones used for MFA¶
Instant Restore is a Duo feature that allows a user to back up the Duo app before switching to a new phone. As long as a Snowflake user backs up their old phone first, they can use Instant Restore to enable authentication on the new phone without interrupting MFA for Snowflake.
If a user does not back up the old phone or loses the old phone, the Snowflake account administrator must help set up a new MFA method. For information, see Recovering a user who is locked out.