To comply with U.S. regulations, Duo now blocks authentications from OFAC-sanctioned countries and regions. This effectively prevents Harvard affiliates based in or travelling to those countries and regions from accessing most University technology, including anything behind HarvardKey.
As of May 5, 2022, Duo—the third-party tool that Harvard and many other institutions use for 2-step verification—began blocking authentications from users whose IP addresses originate in a country or region subject to economic and trade sanctions enforced by the U.S. Office of Foreign Assets Control (OFAC).
This means that Harvard affiliates based in or travelling to the following locations will not be able to access or communicate via most University-provided technology resources (such as VPN, Microsoft 365 Outlook or OneDrive, Zoom, Canvas, and my.harvard):
- Cuba
- Iran
- North Korea
- Sudan
- Syria
- Regions of Ukraine: Crimea, Donetsk, Luhansk, Sevastopol
Harvard affiliates attempting to sign in to HarvardKey- and Duo-protected applications and websites from OFAC-regulated countries or regions will receive an error message and be blocked from completing their login. As a U.S.-based company, Duo is bound by U.S. economic and trade regulations, which prohibit the company from providing services in the sanctioned locations.
If you have questions or concerns, please contact IT Help at ithelp@harvard.edu.
