MFA
Identity
Enrollment, authentication failures, and warnings. The chart is the full pull. The table is the notable slice.
Users
1,842
76 with no factor
Enrolled
96%
1,766 accounts · snapshot
Failures
789
2% of attempts in the window
Warnings
165
4 bypass codes still active
Failures and warnings
Successful pushes are left off this axis. They dwarf everything else and hide the signal.
- Failures
- Warnings
Factor mix
Among enrolled users. Not filtered by the time window.
Push1,288
Hardware token310
WebAuthn168
62 standard accounts still have no factor. 14 break-glass accounts are expected to stay that way. 2 accounts are locked out.
Notable failures and warnings
Not the full authentication log.
| Id | When | User | Factor | Result | Reason | Where |
|---|---|---|---|---|---|---|
| DUO-9D77 | 17 Oct 18:08 | ruth.adeyemi | Push | Failure | Three prompts expired overnight | 192.0.2.91 · unfamiliar city |
| DUO-9C14 | 17 Oct 16:08 | shared-clinical | Push | Warning | Location anomaly after a phishing delivery | 198.51.100.77 · East Campus |
| DUO-9E02 | 17 Oct 14:08 | james.okonkwo | Push | Warning | New device enrollment from an anonymous IP | 198.51.100.18 · guest |
| DUO-9B40 | 17 Oct 02:08 | hannah.cho | WebAuthn | Failure | Invalid passcode on the fallback factor | HQ · known device |
| DUO-9F21 | 16 Oct 16:08 | priya.natarajan | Push | Failure | User marked the push as fraud | 203.0.113.44 · hosting |
| DUO-9AA1 | 16 Oct 10:08 | contractor.park | None | Warning | Account has no factor and signed into VPN | 198.51.100.22 · VPN |
| DUO-9A02 | 11 Oct 06:08 | svc-backup | Push | Failure | Password spray, factor held | 203.0.113.10 · scanner |