how to re-enroll duo on a new phone without helpdesk intervention

TL;DR

Users can move Duo to a new phone themselves if they still have the old one, by reactivating through the device management portal. If the org enables self-service device management, they can do it even without the old phone. Set up the self-service path once and the new-phone tickets mostly stop.

The query

how to re-enroll duo on a new phone without helpdesk intervention

Use this when

• user got a new phone and Duo pushes go to the old one
• deflecting repeated new-phone Duo tickets
• documenting the self-service flow for the knowledge base

Not for

• lost phone with no other enrolled factor (needs helpdesk identity verification)
• Duo never enrolled for the user at all
• orgs that forbid self-service enrollment by policy

Steps

1. If the user still has the old phone, have them sign in to the Duo device management portal and choose to reactivate Duo Mobile on the new phone. Expected output: an activation QR code or link is shown
2. The user installs Duo Mobile on the new phone and scans the QR code or taps the link. Expected output: Duo Mobile activates on the new device
3. The user confirms with a test push. Expected output: the push arrives on the new phone
4. If the old phone is gone, enable self-service device management in the Duo admin panel so users can add devices after authenticating another way. Expected output: policy allows self-service re-enrollment
5. Publish the self-service link where users will find it before they call. Expected output: fewer new-phone tickets reach the queue

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Vc6kTTdc3wgxfIs0iSnVqA