Duo / Two-Step Login: set up a new or replaced phone

Who this is for / when to use it

You got a new phone, a new number, or reset your phone, and now the Cornell Duo / Two-Step Login prompt won't work — the approval still goes to your old device.

Duo or Secure Connect? If your prompt shows a code plus an "Approve" button, that's Duo — you're in the right place. If it shows Beyond Identity or Windows Hello / fingerprint, that's Secure Connect — see it.cornell.edu/secure-connect. Note that even Secure Connect users still need Duo for some services (such as the CU VPN / Cisco AnyConnect), so you can still end up here.

Before you start

Two-Step Login is a Cornell-wide service, so the current step-by-step lives on the IT@Cornell site. Have your new phone and your NetID ready before you begin.

Fix it yourself (fastest)

• Replaced your phone (same or new number)? Start here — Replace Your Smartphone Listed in Two-Step Login. 
• Locked out by failed attempts / need to re-activate: Re-activate Duo Mobile (self-service).
• Adding the app to a new phone: Add Duo Mobile · Duo Restore.
• Remove your old device: Manage Devices.
• Still can't log in: Cornell troubleshooting.

Locked out completely?

If your only registered device is the old or lost one, you can't self-serve — and this is one thing JCB IT can't fix for you. Two-Step Login is a central Cornell service, and only the Cornell IT Service Desk can issue a temporary bypass code or reset your devices (after photo-ID identity verification). Contact them directly:

• Cornell IT Service Desk — it.cornell.edu/support. 
• Or follow Cornell's I can't log in using Two-Step Login guide, which walks you through reaching the Service Desk.

Common problems

• The push still goes to my old number — use Re-activate Duo Mobile, or the Replace Your Smartphone article.
• I don't have my old phone, so I can't approve the new one — you can't self-serve, and JCB IT can't reset this. Contact the Cornell IT Service Desk directly for a bypass code / reset (with ID verification).
• Duo works for everything except the VPN — expected; the CU VPN uses Duo. No smartphone? Cornell recommends a hardware token. 
• My prompt says Beyond Identity — you're on Secure Connect — see it.cornell.edu/secure-connect. Still stuck?

For a Duo lockout / reset, go straight to the Cornell IT Service Desk — that's the only team that can reset Two-Step Login. For anything else (which article applies, VPN prompts, Duo vs. Secure Connect), JCB IT can help point you the right way.

Still need help? Contact the Cornell SC Johnson College of Business Helpdesk at itrequests@business.cornell.edu.

[authored via Jane by rtm25 on 2026-08-18 17:14 UTC]