Frequently Asked Questions about NetID

A NetID is assigned to all applicants, students, faculty, staff and associates at CSU Pueblo starting after the NetID migration (expected in 2023), when existing active eIDs automatically become active NetIDs.

An active NetID and password is required for login to Microsoft 365 email and many other systems at CSU.

CSU Pueblo

• C followed by your 9-digit CSU ID.
  • Example: C899456789

Your CSU ID is a 9-digit number that begins with an 8.

It is a unique identifier for everyone at CSU Pueblo within the university system.

Students and employees can view their CSU ID in Personal Access to Web Services (PAWS): PAWS Student Login or PAWS Employee Login

If you don't know your CSU ID or NetID,

• Applicants: Contact the Admissions Office at (719) 549-2462.
• Current Students: Contact the Registrar's Office at (719) 549-2261.
• Faculty, Staff and Associates: Contact your department's Human Resources representative.

Please note that it may take some time to gain access to your other accounts:

• CSU Pueblo Active Directory account creation may take up to 2 hours.
• Microsoft 365 account creation may take up to 2 hours for Outlook email to be usable.
• Set up Duo Two-Factor Authentication before you log in to your Outlook email account.
• Account creation and updates in other external systems such as Banner, Canvas and Blackboard may take up to 24 hours.

To provide network access to associates of Colorado State University, a department's Human Resources representative must create the new hire or concurrent assignment. The associate can then register for a NetID the day after the assignment has been fully approved.

For more information, contact the human resources department.

The expiration of NetID accounts depends on the individual's affiliation with the University. The following rules apply:

• Applicants: NetID expires 45 days after the application period.
• Students: NetID expires 365 days after the student's last class.
• CSU Pueblo Faculty/Staff: NetID expires 365 days after the end of University affiliation.
• Post-Doctoral fellows, interns, residents and sponsored researchers: NetID expires 30 days after the end of University affiliation.
• Associates: NetID expires 30 days after the appointment ends.
• Retirees: Retirees and Emeritus professors retain their NetID for life.

During the Expiration Cycle, individuals whose accounts are in this phase will still be able to log in to the following systems:

• The NetID website
• Email (Microsoft 365 and G Suite)
• Some other applications that do not require an active affiliation
  • Access to many CSU web applications is based on a person's affiliations, which are stored in Grouper group memberships and LDAP entitlement attributes.
  • When a person's affiliation changes or their association with the University is terminated in HR and/or SIS, their entitlements will also change or be removed accordingly.

CSU System Policies are applicable to members of all institutions within the CSU System. These include:

• Acceptable Use Policy: Explains permitted and prohibited uses of CSU System information technology resources, including computing and data systems, equipment, and services.
• FERPA Policy: Describes student rights and responsibilities regarding the privacy of their education records.

Additionally, individual institutions may have their own specific policies related to information technology:

CSU Pueblo policies on Information Technology Services:

• CSU Pueblo Policy: Password Policy

To change your password if your current password is working, select View/Update > Change Password.

If your account is still active but your password has expired or you have forgotten your password, you can recover it by selecting View/Update > Recover Password.

• Your password must have 15 to 30 characters.
• Only use these characters: letters (a-z and A-Z), numbers (0-9), and the following special characters: ! % + - . : ? [ ] ^ _ ` { | } ~
• Do not include any of these special characters: blank_space @ $ & " ( ) ' ; = # * < > , / \
• Do not include your CSU ID, legal first name, or legal last name in your password.
• Do not use just one dictionary word, even if it meets the length requirement.
• Do not reuse a password that you have previously used for this account.
• Do not repeat a character 5 or more times consecutively (e.g., "aaaaabbbbbccccc").
• You must change your password at least every 12 months.

• Remember that your password is case-sensitive. Ensure that the Caps Lock key is not activated.
• Choose a password that is unique and not easily guessed.
  • Do not use the same password on any other websites or accounts.
  • Avoid using personal information that others may know or find online, such as your address, phone number, date of birth, family or friend names.
  • Avoid using common book, movie, or game titles, as well as grammatically correct phrases.
  • Avoid using repeated words or sequences (e.g., "12345asdfg12345asdfg").
• Select a password that is easy for you to remember.
  • Consider using a series of unrelated words that hold personal meaning to you (e.g., "DryNymphGnatTrout" or "dry-nymph-gnat-trout")

NetID passwords have a one-year expiration period. Your password will expire one year after it was created or last changed.

To check the expiration date of your password, follow these steps:

• Select View/Update > Show My Information.
• Look for Password Expires under the NetID Account section. This will indicate when your password is set to expire.

To recover your password, follow these steps:

1. Select View/Update > Recover Password from the top menu.
2. Enter your NetID and provide your non-CSU recovery email address.
3. Check the box next to "I'm not a robot" and click Send.
   An email will be sent to your non-CSU recovery email address.
4. Log in to your non-CSU recovery email account.
5. Open the email message from NetID@colostate.edu with the subject line NetID Account Recovery Request.
6. Click the link in the message, which starts with https://eid.colostate.edu/csusystem/token.aspx?token=.
7. A new browser window or tab should open. Enter your NetID and click Continue
8. Review the password requirements, and enter and confirm your new password.
9. Click Save. Once you have successfully saved your new password, your account will be updated, and you should be able to access your account using the new password.

Effective February 9, 2023, the Duo Mobile app will no longer support Android 8, Android 9, and iOS 13. Users will continue to be able to authenticate. However, no support or troubleshooting will be available if issues are encountered. We recommended users upgrade to the latest iOS or Android version.

Two-factor authentication makes your account more secure by requiring an additional piece of information beyond your username and password.

When you log in to some CSU systems, you will be required to validate your login credentials using a device you possess.

Ways to Authenticate with Duo Mobile (Devices)

• Use the Duo Mobile app on your smartphone or tablet (recommended)
• Receive a call from a phone you registered
• Generate a six-digit key from a hardware token you purchase

• Microsoft 365 applications (OneDrive, Teams, etc.) and university email accounts
  • Required for all students, faculty and staff
• CSU VPN services for secure off-campus access to CSU resources
  
  • GlobalProtect web interface: CSU Pueblo
  • GlobalProtect Agent: desktop client for PC or Mac, or mobile app for Android or iOS
• Kuali (Financials and Research)
• Duo is gradually being enabled on other systems throughout CSU.

1. Download and install the  Duo Mobile app from Duo Security LLC:
   •  Duo Mobile app for iPhone
   •  Duo Mobile app for Android
   •  Duo Mobile app for Windows Phone
2. Log in to the NetID website. Click Login, select your campus, and enter your NetID and password.
3. Select Two-Factor Authentication (Duo) from the View/Update menu.
4. Check the Enable Two-Factor Authentication box and click Save to enable two-factor authentication on your NetID account.
5. Register and activate at least one device.
   1. Click the + Register Device button.
   2. You should see the Register Device screen.
   3. Device Name: Enter a description that will help you recognize the device, such as cellphone, tablet, office phone, or my Samsung Galaxy S21.
   4. Phone Number: Enter the 10-digit phone number of the device, or leave blank for a tablet.
   5. Type: Select the type of authentication you would like to use. DUO Mobile App is recommended. For a land line, you must use phone call.
   6. Platform: Select the operating system of your device (such as Apple iOS, Google Android, or Windows Phone).
      If you are not using the Duo Mobile app, select Generic Phone or Landline.
   7. Click Save. If you are using the Duo Mobile app, you will see the Two-Factor Device Activation screen with a QR code.
   Then on your device,
   1. Open the Duo Mobile app.
   2. Select Set Up Account, or the  or  Add icon in the top right if you already have a Duo authentication with another entity.
   3. Select Use QR Code in your device.
   4. Use your device to scan the QR code on the web page. Your device will be automatically connected with the NetID application.
   5. On the Name Account screen, modify the Account name if desired, and tap Save.
   6. On the web page, click the Return link. Your device will appear at the bottom of the list of registered devices.

• Register a second device.
  • You are encouraged to have a second device registered at all times, to prevent being locked out of your account in case your primary device is lost or unusable.

This can happen if you are not able to successfully register a device before your browser session ended.

1. After you log in with your NetID, you will see the Protect Your Colorado State University Account screen. Click Start setup.
2. Select a device and click Continue. Mobile phone or Tablet is recommended. Select Landline if you are not using a mobile app.
3. Enter your 10-digit phone number. If it is correct, check the box and click Continue.
4. Select the type of phone -- iPhone, Android, Windows Phone, or Other (and cell phones) -- and click Continue.

• If you selected iPhone, Android or Windows Phone,
  1. Install Duo Mobile on your device as instructed if you haven't already installed it, then click I have Duo Mobile Installed.
  2. On the Activate Duo Mobile screen you will see a QR code.
  Then on your device,
  1. Open the Duo Mobile app.
  2. Select Set Up Account, or the or  Add icon in the top right if you already have a Duo authentication with another entity.
  3. Select Use QR Code in your device.
  4. Use your device to scan the QR code on the web page. Your device will be automatically connected with the NetID application.
  5. On the Name Account screen, modify the Account name if desired, and tap Save.
  6. On the web page, you will see a green checkbox inside the QR code indicating that the device was activated. Click Continue.
• If you do not have a device with Duo Mobile, or if you were not prompted to select a device, you will see the Verify Ownership screen.
  1. Click Call me. Answer the call on your mobile device. Enter the 6-digit code you hear into the box in step 2 and click Verify.
  2. If the code is correct, you will see a green check mark next to the Verify button. Click Continue.
  3. You should see the device you just added.
  4. Select an option from the When I log in: menu. Leave the default option to ask you every time, or select either call or Duo Push if you will always be using the same method.
  5. Click Continue to Login.

5. You will see a screen with a message in green at the bottom indicating Enrollment successful! and options to send a push, call, or enter a passcode.
6. If you click Send Me a Push, you will see a message in blue at the bottom indicating Pushed a login request to your device....
7. On your device, look for a login request from Colorado State University with text "Are you logging in to NetID Self Service - Single Sign On?".
8. Tap Approve in either the popup or larger window.
9. You will then see the Approved screen on your device. On the web page, you will briefly see Success! Logging you in... on the bottom green bar and will be logged in to the NetID website.
10. Select Two-Factor Authentication (Duo) from the View/Update menu to verify that you now have one registered device.
11. Register a second device by clicking the + Register Device button.
    • You are encouraged to have a second device registered at all times, to prevent being locked out of your account in case your primary device is lost or unusable.

If your phone is already in the Registered Devices list, you do not need to add it again.

If you have created a Duo account with both your CSU eID and CSU System NetID, and both accounts use the same phone number, choose one of these workarounds:

• If you have not registered any other devices, log out and log in again, and follow the instructions for registering a device if none are registered.
• If you will only be logging in with this device using Duo "Send Me a Push" and not a phone call, you can leave the phone number blank.
• If you must include a phone number, you could enter an arbitrary number in the optional Extension field.
  (An extension is one or more extra digits normally used to connect to an internal phone of a business or organization.
  A fake extension, such as 99, would be ignored by most phones, and the combination of phone number plus extension would be unique for Duo purposes.)
• If you are no longer using the device for Duo login with CSU eID, remove the device from the eID Duo page.

• Duo Two-Factor Authentication
• Duo FAQs and User Guides

To view and change your email alias after activating your NetID, follow these steps:

1. Select View/Update > Email Alias.
2. Choose your CSU Email First Name from the menu. If your preference is not listed, select Other (please specify) and enter a different name.
3. Select your CSU Email Domain if you are affiliated at more than one CSU campus or your campus is not already selected. (Choose colostate.edu for Fort Collins or csupueblo.edu for Pueblo.)
4. Verify that the New Email Address displays the email address you wish to use.
5. Click Save to save the changes.

Messages sent to your old email alias will continue to be delivered to your inbox until the old email alias expires after 6 months.

Once it expires, any messages sent to it will be returned as "undeliverable" unless the alias is taken by someone else.

Your deliverable email address is your NetID@colostate.edu.

The deliverable address refers to the internal name for the location on a mail server where your emails are stored. It is the actual address to which emails sent to your email alias are delivered.

Your deliverable address is also used as your Microsoft 365 account login and User Principal Name (UPN) in Microsoft Windows Active Directory.

1. Go to Microsoft 365 Outlook.
2. Sign in with your service account NetID and domain (netid@colostate.edu) and your service account password.

You may want to use preferred first and last names that are different from your legal names.

For example, many people have nicknames, and someone with hyphenated last names may want only one of the last names displayed.

1. Go to View/Update > Preferred First Name.
2. Update your preferred first name and click Save.

• Students: Contact the Office of the Registrar.
• Faculty/Staff/Associates: Contact your hiring/onboarding Departmental HR Representative.

A NetID service account is a CSU NetID that is owned by a department.

Most service accounts include a Microsoft 365 account (including Outlook email, OneDrive cloud storage, and other Microsoft Office applications), but some do not, including administrative service accounts.

A NetID service account can be used by one CSU faculty and staff member, or multiple faculty and staff by securely sharing the username and password if necessary.

Common uses include:

• A central email address for shared contact and support (for a department, unit or website). (Consider a shared mailbox for this purpose if this is the only requirement.)
• An email account with a short email address (such as depthelp@colostate.edu) that the owner might want to configure to serve as an alias and automatically forward all mail to a shared mailbox with a longer email address (such as dept_helpdesk@colostate.edu) so the service account password does not need to be shared.
• A secondary inbox for a single person to receive emails for specific purposes, such as a secondary job role or large student documents.
• Group access to CSU lab or facility resources where authentication from multiple individual CSU user accounts is not feasible or practical.
• Short-term access for non-CSU partners (e.g. training, conference or workshop attendees who need to be contacted via CSU email, or would be too constrained by the csu-guest Wi-Fi, and guest speakers who need to use computer labs). The password should be updated after each use.
• A true service account: a non-personal digital identity for machine-to-machine communication, application and data access, and running batch jobs, scripts or automated services.
• IT, PC, software or web development testing or logging.

You do not need a service account if you only need a shared mailbox or mailing list for your unit.

1. Review information about CSU Microsoft 365 resource management including:
   • shared mailboxes
   • email aliases
   • mailing lists
2. Look up and contact the CSU Microsoft 365/Exchange Resource Coordinator for your department.

You do not need a service account if you only need to share documents and files within your unit. Some options include:

Shared Drives

• Microsoft 365 at CSU: OneDrive for Business (5 TB, can be extended): Share and Collaborate with OneDrive
• Google Workspace for Education at CSU: Google Drive (just 25 GB): Share files and other content with a group

Collaboration Tools and Websites

• Microsoft Teams at CSU: File Sharing
• Microsoft SharePoint sites at CSU
• Google Sites

Service accounts can function for basic testing of single sign-on.

However, by default an LDAP record is not created, so no LDAP entitlements or other attributes are released to applications, and many systems rely on CSU ID for access.

Only a small number of service accounts have an LDAP record. They have been created for testing purposes or administrative accounts for automated services, and they a very limited set of test attributes.

A primary NetID account is generally needed to test attribute release and group- or role-based authorization in a Shibboleth-protected web application.

A shared account that can access many CSU resources is a security issue.

Service account users and administrators must be CSU Fort Collins faculty or staff members.

CSU Microsoft 365/Exchange Resource Coordinators should submit service account requests on behalf of CSU faculty and staff members.

Multiple people can administer a service account. Administrators for each service account are members in a service account Grouper group.

Service accounts should only be used by CSU faculty and staff.

If an account is needed for others, request a guest associate NetID from your departmental Human Resources representative.

Additional information about associates from CSU Human Resources

Although one or more individual faculty and staff members can use and administer a service account, each service account is associated with and owned by a department.

This assures that new administrators can be easily assigned to the service account in Grouper when the previous administrator departs.

Starting May 31, 2023,

• You will use the CSU System NetID website to view details of each service account and change the password.
• You will use Grouper to manage the service account administrators (instead of contacting us to transfer ownership).

Your access to the existing email account will not change or be interrupted during the transition.

Secondary NetIDs that you did not select for migration to a service account will be unavailable for password changes starting May 24, 2023 and will be deactivated on October 2, 2023.

If you would like your secondary NetID deactivated immediately, please contact us. Otherwise, you can simply let it be deactivated.

Secondary NetIDs are still in the WEID_DIR_PERSON_00 Banner database table, but they will no longer be updated starting May 31, 2023, and they will be completely removed when the table is replaced by a view during the NetID migration in July.

Current service account data is available to NetID administrators and service account requesters in the Admin menu on the Service Accounts page.

Copy the following table and paste into an email message to a Service Account Requester or CSU Microsoft 365/Exchange Resource Coordinator for your department or unit:

Subject: NetID Service Account Request

Your CSU Microsoft 365/Exchange Resource Coordinator can review your request, approve it, and submit it as a Service Account Request.

2-8 lowercase letters (a-z) and digits (0-9), starting with a letter.

Not allowed: Uppercase letters, spaces, underscores, hyphens, accents, special characters

If your unit needs an email address with more than 8 characters, contact your CSU Microsoft 365/Exchange Resource Coordinator to request a shared mailbox.

Service accounts do not have a regular CSU ID because they are owned by a department and not an individual.
(This makes it easy to add and remove service account administrators in Grouper.)

The CSU ID of the initial administrator is stored for administrative purposes only.
(Also, a 9-digit number starting with 2 is generated as an identifier for applications that require a CSU ID.)

1. Click Login, select your campus, and log in with your primary NetID.
2. To list service accounts you administer, go to View/Update > Service Accounts.
3. To administer or view full details of a service account, click the Service Account NetID in the left column of the table.
4. To update details of the service account, change editable fields Account Name and Account Description and click Save. (Other details can only be updated by NetID full admins.)
5. To change the password, click Change Password and see instructions below.
6. To view or change the service account's administrators, click Manage Admins and see instructions below.

1. Click Login, select your campus, and log in with your primary NetID.
2. Go to View/Update > Service Accounts.
3. Click the Service Account NetID in the left column of the table.
4. To change the password, click Change Password. You will be prompted for a new password for the service account.

Note: Only service account admins can change the password. (You cannot change the password by logging in to the NetID website with your service account NetID and password.)

Share passwords verbally (in person or by phone), through encrypted email, or through a password manager.

Unencrypted email, SMS text messages, plain text files, and instant messengers generally are not secure ways to share passwords.

Grouper is a web-based tool for creating, viewing and managing groups, members, roles and permissions. These groups are used to authorize access to NetID service accounts and many other CSU online applications.

For more information, see Grouper at CSU (requires CSU GlobalProtect VPN login to access from off campus).

To add or remove group members, see instructions for Grouper Group Management (PDF).

NetID admins and service account requesters can view a list of all service accounts at Admin > Service Accounts.

NetID service account requesters can also view their own service account requests, and edit their requests that have not yet been processed (with status "requested").

NetID service account administrators can view the individual service accounts they administer at View/Update > Service Accounts.

Review the presentation slides from the Open Forum on NetID Service Accounts (PDF, May 24, 2023).

Watch the Microsoft Stream recording (requires NetID login).

• Walk In: Library and Academic Resource Center (LARC), First Floor, Office 130
• Phone: (719) 549-2002
• Email: helpdesk@csupueblo.edu
• Web: Support Ticket