Beginning June 26, ITS will require current and former students to use Duo Security (Duo) to provide stronger identity verification before logging into ConnectCarolina. Many users will have a second option to verify their identity — Carolina Key.
Duo is one of the 2-Step Verification tools that the University uses to protect sensitive systems and data. After you log in with your Onyen and password, Duo prompts you to prove your identity with a second method like approving a push notification or entering a passcode. All users can enroll in Duo.
Carolina Key replaces both Duo and your password with a passkey. Passkeys provide stronger protection against attacks like phishing by verifying your identity using your registered device, like your laptop or smartphone, instead of your password. Authentication methods vary by device, but include options like facial recognition, fingerprint scanning or entering a PIN. Current UNC students and employees are eligible to enroll in Carolina Key.
Users who are not registered for either Duo or Carolina Key will be required to enroll before they can access ConnectCarolina. Users need to first enroll in Duo before boosting their security and convenience with Carolina Key.
For guidance enrolling in Duo or managing devices, view documentation on the Help Portal. For more information about Carolina Key and to register your device, visit the Carolina Key website.
Who this affects
This requirement defines a student as anyone who has ever taken a class at Carolina and includes:
- Currently enrolled, admitted, pre-matriculated and matriculated students
- Former students and/or alumni who access ConnectCarolina using an Onyen or Guest ID
- Employees who are alumni, are currently taking classes at Carolina, or who have ever taken a class at Carolina
Users who are already required to use Duo when accessing ConnectCarolina will continue to use Duo, or Carolina Key, at login. Their login process and requirements will not change.
Protects consumer information
Earlier this year, the U.S. Department of Education clarified how universities should follow the Gramm-Leach-Bliley Act (GLBA), which protects consumer information. ITS is helping the University comply by strengthening ConnectCarolina’s security.
Specifically, the Safeguards Rule requests that organizations, including universities, take additional measures to secure students’ financial aid information. The Department of Education stated that the increased safeguards apply to both current and former students.
Fast, secure logins with Carolina Key
For fast, simple and safe logins to many University systems, ITS encourages current students and employees to enroll in Carolina Key because it replaces your password with a passkey that is resistant to phishing attacks.
Because Carolina Key is highly secure, it can replace more than just your password — it can also replace Duo. That means that when you’re signing into ConnectCarolina, instead of typing your password and authenticating with Duo — just use Carolina Key. In practical terms, that means fewer clicks, less typing, faster logins and yes — more security.
If you leave your Carolina Key enrolled device at home, forget your PIN, or log in to a new computer, no problem. You can still log in with your password and Duo.
Carolina Key works on web-based UNC systems that use Single Sign-On (SSO). While Single Sign-On may not be a familiar name, Tar Heels use SSO — and an Onyen and password — to log into many campus systems, including ConnectCarolina, Canvas and the Time Information Management (TIM) system. Non-SSO systems like Microsoft 365 will still use an Onyen and password.
Learn more and register your devices at Carolina Key. You can also read about the industry’s move to passkeys in a two-part series from last year — A future without passwords: Part I and A future without Passwords: Part II, which focuses specifically on Carolina Key.