Preparing for UCSB Multi-Factor Authentication (MFA)

Enterprise Technology Services (ETS) will be rolling out Duo Multi-Factor Authentication (MFA) for the campus instance of Connect/Google Workspace.  This will affect Gmail, Calendar, Drive and all other Google apps associated with your UCSBnetID account.  Once Duo MFA is enabled for your Google account, you will be prompted for the UC Santa Barbara Single Sign-On (SSO) screen followed by the Duo MFA prompt to send a push to your phone or enter a passcode.  UCSB's SSO/Duo MFA will be the new prompt for authentication after you sign in to your Google account.

This will be required for all active/current Employees (Faculty & Staff), Students, and Affiliates.  If you are separated but still use your UCSB Google Workspace account, you will need to enable Google's 2-Step Verification.

Google's version of MFA called 2-Step Verification (2SV).  The best way to prepare for UCSB's rollout of SSO/Duo MFA, is to set up Google's 2-Step Verification now.  Doing this now will ensure your Connect/Google Workspace account is kept secure before and after separating from campus.

If you have an active Connect/Google Workspace account, regardless of your affiliation to the campus, you will be required to use either UCSB's SSO/Duo MFA or Google's 2SV.  UCSB can automate your SSO/Duo MFA setup, but Google's 2SV needs to be enabled by you.

NOTE:  If you have enrolled in Google's "Advanced Protection Program" you will be prompted for UCSB's SSO/Duo MFA and Google's 2SV.

For specific questions about authenticating, please see the Connect FAQs.

The following security requirements will be determined by your affiliation with campus.

UC Santa Barbara Affiliations

Employees - UCSB Faculty & Staff (professors, business officers, advisors, personnel analysts, technicians, groundskeepers, etc.)

  Employees can have the following statuses

  • Active - UCSB SSO/Duo MFA will be enforced. 
  • Separated with an Active Connect account - Google's 2-Step Verification will be enforced.  If not enabled on your account, you will be prompted to set it up.
  • Separated with an Inactive Connect account - If you are separated from the university and your Connect account was deactivated by your department, you will get an access denied error from Google when you try to sign in.

Affiliates - Contractors or Academic Affiliates

  Affiliates can have the following statuses

  • Active - UCSB SSO/Duo MFA will be enforced. 
  • Separated with an Active Connect account - Google's 2-Step Verification will be enforced.  If not enabled on your account, you will be prompted to set this up.
  • Separated with an Inactive Connect account - If you are separated from the university and your Connect account was deactivated by your department, you will get an access denied error from Google when you try to sign in.

Students

  Students can have the following statuses

  • Active (Enrolled) - UCSB SSO/Duo MFA will be enforced.
  • Former - Google's 2-Step Verification will be enforced.  If not enabled on your account, you will be prompted to set this up.
  • Graduated - Google's 2-Step Verification will be enforced.  If not enabled on your account, you will be prompted to set this up.

Connect Functional Accounts - These are role-based Connect accounts created by your Connect Department Admin.  These accounts are not associated with a UCSBnetID.  The sponsor should have the login credentials and we suggest granting Google's delegate access to those who need it.

  Functional accounts can have the following statuses

  • Active - UCSB SSO/Duo MFA will be enforced.
  • Deactivated - If your CDA deactivated a functional account, you will get an access denied error from Google when you try to sign in.

Emeriti - Retired UCSB Faculty with emeriti status

  Emeriti can have the following statuses

  • Active - UCSB SSO/Duo MFA will be enforced. 
  • Separated with an Active Connect account - Google's 2-Step Verification will be enforced.  If not enabled on your account, you will be prompted to set it up.
  • Separated with an Inactive Connect account - If you are separated from the university and your Connect account was deactivated by your department, you will get an access denied error from Google when you try to sign in.