When users log in for the first time using TFA, they have to complete a self-enrollment process, which is provided by Duo and their Web SDK. Duo enrollment and authentication can be completed They have both a "traditional" and "universal" enrollment module. You can choose which one to use with the configuration settings in your Duo account. The main differences between the "traditional" and "universal" enrollment modules are that the "universal" process is designed to be more streamlined and involve fewer steps.
The process is embedded in the user interface of Dayforce so that users don’t have to log in to Duo separately:
Note: The account name (shown as "Dayforce" in the preceding screenshot) can be configured in the Duo administration site. You can also further brand it with your organization's logo.
For users, the enrollment process involves choosing which type of device to enroll: a mobile phone, tablet, or landline phone, security key, or touch ID. Enrollment can also be done using the mobile app. Once a user is enrolled in TFA, they are enrolled for all versions of Dayforce. For more information on the Duo self-enrollment process, see the documentation at the following URL: https://guide.duo.com/traditional-enrollment
After they have enrolled, users are presented with the TFA process when they log in, which they complete with their device:
Once authenticated, users are logged in to Dayforce.