Frequently Asked Questions about NetID

Your NetID is a Colorado State University System network identity that replaces CSU Pueblo eAccounts and CSU Fort Collins eIDs.

A NetID is assigned to all applicants, students, faculty, staff and associates at CSU Pueblo, and CSU Fort Collins starting after the NetID migration (expected in 2023), when existing active eIDs automatically become active NetIDs.

An active NetID and password is required for login to Microsoft 365 email and many other systems at CSU.

CSU Fort Collins

If you joined CSU after July 24, 2023, your NetID follows the new standard format:

• C followed by your 9-digit CSU ID
• Automatically generated
• Example: C899456789

If you were associated with CSU Fort Collins prior to July 24, 2023 and your account was active in 2022 or later, your eName/eID automatically became your NetID:

• 2 to 8 lowercase characters starting with a letter
• Created by the user
• Example: xgarcia

If your account was not active in 2022 or 2023 but you reestablished your affiliation with CSU, your eName/eID would have been expired and you would be issued a new NetID in the C# format.

CSU Pueblo

• C followed by your 9-digit CSU ID
• Example: C899456789

Your CSU ID is a 9-digit number that begins with an 8.

It is a unique identifier for everyone at CSU Pueblo and CSU Fort Collins within the university systems.

CSU Fort Collins

• Students, Faculty and Staff: Get your RamCard from the RamCard office. Your CSU ID appears on this card and begins with 82 or 83.
• You can also see your CSU ID when you log in to the NetID website.
• Students: You can also view your CSU ID when you log in to RAMweb. For instructions, refer to How to find your Colorado State University CSU ID Number.

If you don't know your CSU ID or NetID,

• Applicants: Contact the Office of Admissions at (970) 491-6909.
• Current Students: Contact the Office of the Registrar at (970) 491-4860.
• Faculty, Staff and Associates: Contact your department's Human Resource representative.

CSU Pueblo

You can view your CSU ID and NetID in Personal Access to Web Services (PAWS):

• Current Students: PAWS Student Login
• Faculty and Staff: PAWS Employee Login

If you don't know your CSU ID or NetID,

• Applicants: Contact the Admissions Office at (719) 549-2462.
• Current Students: Contact the Registrar's Office at (719) 549-2261.
• Faculty, Staff and Associates: Contact your department's Human Resource representative.

CSU Fort Collins

• Email: Microsoft 365 (Outlook), and Google Workspace (Gmail)
• GlobalProtect VPN: CSU Fort Collins
• RAMweb student portal
• Canvas LMS
• ARIESweb SIS
• Administrative Applications and Resources (including HR System, Kuali, TimeClock Plus)
• CSU Fort Collins library catalog
• many central IT, college and department applications

CSU Pueblo

• Email: Microsoft 365 (Outlook)
• GlobalProtect VPN: CSU Pueblo
• PAWS student portal
• Blackboard LMS
• TWOLFnet device registration
• CSU Pueblo library catalog
• many other applications

Due to the many CSU and federated systems that use your NetID as a unique identifier for single sign-on, we are unable to change eIDs (eNames) to the new NetID format.

To provide network access to associates of Colorado State University, a department's Human Resources representative must create the new hire or concurrent assignment. The associate can then register for a NetID the day after the assignment has been fully approved.

For more information, see Associates section on the HR website.

CSU System Policies are applicable to members of all institutions within the CSU System. These include:

• Acceptable Use Policy: Explains permitted and prohibited uses of CSU System information technology resources, including computing and data systems, equipment, and services.
• FERPA Policy: Describes student rights and responsibilities regarding the privacy of their education records.

Additionally, individual institutions may have their own specific policies related to information technology:

CSU Fort Collins policies on Information Technology:

• CSU Policy: Acceptable Use for Computing and Networking Resources
• CSU Policy: Information Technology Security
• CSU Policy: Network Identity

CSU Pueblo policies on Information Technology Services:

• CSU Pueblo Policy: Password Policy

NetID at CSU Fort Collins

NetID at CSU Pueblo

To activate your NetID, follow these steps.

1. Select Activate from the top menu.
   1. Enter your NetID.
   2. Enter your activation email address. This is usually the non-CSU email address you used during the admission or employment application process. If you're unsure, contact the Admissions or Human Resources office.
   3. Check the box next to "I'm not a robot".
   4. Click Send. An activation email for your NetID will be sent to the email address you provided.
   
2. Log in to your non-CSU activation email account.
   1. Open the email from NetID@colostate.edu with subject line NetID Account Activation Request.
   2. Click the link in the message, which starts with https://netid.colostate.edu/token.aspx?token= .
   
3. A new browser window or tab should open.
   1. Re-enter your NetID and click Continue.
   2. Enter your preferred first name.
   3. Select your Preferred Email Address.
      1. Choose a first name for your CSU email alias from the provided options. If your preference is not listed, select Other and enter your choice.
      2. Select a last name for your CSU email alias if your preferred last name is different from your legal last name.
      3. Select your preferred email domain (colostate.edu for Fort Collins or csupueblo.edu for CSU Pueblo) if you are associated with more than one CSU campus.
   4. Enter a non-CSU email address to use for password recovery. This defaults to your non-CSU activation email.
   5. Create and confirm a NetID password.
   6. Review the CSU System Acceptable Use Policy and check the box.
   7. Click Activate. Your NetID will be activated, and a confirmation email will be sent to your activation email address.
   

To activate your NetID, you need to be a CSU applicant, admitted student, or recently hird faculty or staff member with a new NetID, or you have returned to CSU after your NetID expired.

Your NetID needs to be in the "Awaiting Activation" life cycle state; it must not be already active, expiring or expired.

Account Access

These services take time to activate before you can access them:

• Microsoft 365 (Outlook for email and calendar, Teams, OneDrive, and other services) - up to 2 hours
• CSU Pueblo Active Directory (for NetID login) - up to 2 hours
• Banner, Canvas, Blackboard, and other external services - up to 24 hours

See the Contacts page for contact details.

CSU Fort Collins

• Student applicants and returning students should contact Admissions.
• Admitted students should contact the Registrar.
• Alumni and former students who need to access their personal records should use RAMrecords.
• Faculty, staff and associates should contact the Human Resources representative for their department.

Life Cycle State	Email Access	Description and Access
Awaiting Activation	No	You are eligible to activate your NetID and email account.
Active Account	Yes	You have activated your NetID account. You have access to CSU email and other systems based on your campus and affiliation(s) (student, faculty, staff, associate).
Expiration Cycle	Yes	You are no longer affiliated with CSU as a student, employee or associate. You can still access your CSU email but no longer have access to most other CSU systems.
Expired Account	No	After your CSU affiliation ends, you must reestablish an affiliation to access email or other CSU systems.
Manual Disable	No	Your account has been manually disabled by a NetID administrator. Contact us for more information.

The expiration of NetID accounts depends on your affiliation with the University. The following rules apply:

• Applicants: NetID expires 45 days after the application period.
• Students: NetID expires 365 days after the student's last class.
• CSU Fort Collins Faculty/Staff: NetID expires 30 days after the end of University affiliation (employee's separation from the University or the Appointment End Date, if applicable).
• CSU Pueblo Faculty/Staff: NetID expires 365 days after the end of University affiliation.
• Post-Doctoral fellows, interns, residents and sponsored researchers: NetID expires 30 days after the end of University affiliation.
• Associates: NetID expires 30 days after the appointment ends.
• Retirees: Retirees and Emeritus professors retain their NetID for life.

When your NetID account expires, you will lose access to all CSU accounts, including email, cloud drives and other office applications (Microsoft 365 and Google Workspace for Education).

Starting 30 days before account expiration, account holders are reminded of the expiration date multiple times by email to both CSU and recovery email addresses.

You can reestablish your eligibility for a NetID in one of the following ways:

• Register for a credit course.
• Become a full-time or part-time employee.
• Become an associate. (Contact the department with which you have a working relationship.)

Please contact the appropriate office (Admissions, the Registrar, CSU Online, or the Human Resources liaison of your department). They can check their systems and make any necessary updates if you have already reestablished your eligibility but the NetID system is not yet recognizing it.

If your account is in the Expiration Cycle state, you will still be able to log in to the following systems:

• The NetID website
• Email, cloud drives and other office applications (Microsoft 365 and Google Workspace for Education)
• Some other applications that require NetID login but do not require an active affiliation.
  • Access to many CSU web applications is based on your campus and affiliations (student, faculty, staff and/or associate).
  • When your affiliation changes or your association with the University is terminated, your access will also change or be removed.

Inform other people and accounts of your email change.

• Automatically forward your emails to your new email address while your NetID account is still active. See instructions for Microsoft Outlook or Gmail.
• Set an automatic reply to inform others of your new email address while your NetID account is still active. See instructions for Microsoft Outlook or Gmail.
• (Forwarding and automatic replies will end when your account expires.)
• Change your social media and commercial accounts to use a non-CSU email address for second factor login and account recovery. Otherwise you might someday find that you are locked out of your accounts.

Transfer information you want to keep.

• Download or transfer to other systems any existing CSU content you want to keep, such as email messages, drive files, and contacts. See instructions for Microsoft 365 or Google.
• Note that files and folders in your OneDrive folder that are currently being synced with your CSU OneDrive account will no longer be available when your NetID expires, so they should be moved outside of your OneDrive folder. Also see Transfer files to your personal OneDrive with the Mover Transfer Wizard.
• For transferring OneNote, see Export and import OneNote notebooks.
• Log in to your downloaded Microsoft applications (Outlook, Word, Excel, etc.) with a non-CSU Microsoft 365 account.

Create accounts for former students.

• CSU Alumni and former students should create a RAMrecords ID to access their personal records.
• CSU Alumni can create a Gmail account for CSU Alumni.

Request deactivation of your NetID.

Eligibility

• Your NetID must be expiring in the next 30 days or expired less than 30 days ago. CSU Microsoft 365 and Google accounts are permanently deleted 30 days after NetID expiration and cannot be recovered.
• You can request a one-time, two-week extension of your NetID.
• To keep your NetID active, see above to reestablish NetID eligibility.

Contacts

• Students: Contact your campus help desk.
• Faculty, Staff and Associates: Contact your former department's Human Resources representative. They should decide whether to authorize the temporary extension and submit the request to the campus help desk on your behalf.
  You may want an extension if your employee or associate affiliation is being reactivated or extended or your primary assignment is changing, but processing won't be completed before your NetID expiration date.
  Note: Division of IT staff cannot perform NetID extensions or reactivations without authorization from central HR or an HR representative.

Thank you for considering deactivating your unused accounts to benefit yourself, CSU, and the environment.

• Protect the online privacy and security of yourself and others at CSU. (Hacked unused accounts may go unnoticed and are a large security risk for CSU.)
• Reduce CSU software licensing costs.
• Reduce online resource usage and environmental impact.

Instructions

1. When your NetID is deactivated, you will lose access to all your CSU accounts that use your NetID for login, including Microsoft 365 and Google email messages, drive files, and contacts, and reactivation eligibility is limited.
2. To make sure you no longer need your CSU accounts, follow instructions for preparing to close your CSU accounts.
3. Make sure you have ended your CSU affiliation(s). Contact Admissions, the Registrar, or Human Resources, if necessary.
   • Your NetID account remains active until you end your CSU affiliation(s).
   • We cannot permanently deactivate active accounts of CSU applicants, students, faculty or staff.
   • If your affiliation is emeritus or retiree, please contact Human Resources.
4. Go to My Account > Show My Information. In the NetID Account section, check that Life Cycle State is Expiration Cycle.
5. To request deactivation of your NetID, please contact your campus help desk.

Email notifications of password and account changes and expiration will be sent to both your CSU First.Last email address and your non-CSU recovery email address.

You will be notified whenever these changes are made to your NetID, to alert you in case you did not make the change:

• NetID activation
• Password
• CSU first.last email address
• Non-CSU recovery email address
• Preferred first name
• Duo two-factor authentication activation and devices

You will also be notified when your NetID password or account is scheduled to expire:

• The first reminder email is sent 30 days before the expiration date. Reminders continue weekly until the expiration date.
• Password expiration notifications include your password expiration date and instructions for changing your password.
• Account expiration notifications include information on keeping your account active or preparing for your NetID and CSU accounts to expire.

How to check that the email is legitimate and not a phishing attack:

• The email will come from the NetID@colostate.edu email address.
• The message will address you by full name and include your NetID.
• Links will go to valid CSU sites like netid.colostate.edu, it.colostate.edu and www.csupueblo.edu.
  • Hover over links to preview destinations.
  • You can also type netid.colostate.edu or it.colostate.edu into the address bar of your browser rather than clicking a link.
• Select My Account > Show My Information and check the NetID Account section to confirm your password and account expiration dates.

Additional security tips:

• If you are unsure if an email is legitimate, or suspect your account was compromised, see cybersecurity contacts, awareness and training.
• If your account has been compromised and we detect that your account is sending phishing emails, your NetID password will be reset to a random value, your recovery emails will be removed, and you will be contacted by CSU IT incident response.
• CSU staff will never ask for your password in a phone call, an email message, or text message.

To change your password if your current password is working, select My Account > Change Password.

If your account is still active but your password has expired or you have forgotten your password, you can recover it by selecting My Account > Recover Password.

• Your password must have 15 to 30 characters.
• Only use these characters: letters (a-z and A-Z), numbers (0-9), and the following special characters: ! % + - . : ? [ ] ^ _ ` { | } ~
• Do not include any of these special characters: blank_space @ $ & " ( ) ' ; = # * < > , / \
• Do not include your CSU ID, legal first name, or legal last name in your password.
• Do not use just one word in a dictionary of any language, even if it meets the length requirement.
• Do not reuse a password that you have previously used for this account.
• Do not repeat a character 5 or more times consecutively (e.g., "aaaaabbbbbccccc").
• You must change your password at least every 12 months.

• Remember that your password is case-sensitive. Ensure that the Caps Lock key is not activated.
• Choose a unique password. Use a different password on all work and personal accounts.
  • Use a password manager to help you create and manage unique, long passwords for many different websites.
• Choose a password that is hard for people and bots to guess.
  • Avoid using personal information that can be easily accessed or guessed.
  • Avoid using common phrases and book, movie, and game titles.
  • Avoid using repeated words or sequences (e.g., "12345asdfg12345asdfg").
• Select a password that is easy for you to remember.
  • Consider using a unique passphrase of words that hold personal meaning to you (e.g., "DryNymphGnatTrout" or "dry-nymph-gnat-trout")

• Set up Two-Factor Authentication (Duo).
• Add or update your NetID recovery email address.
• CSU Cybersecurity Awareness and Training: Learn how to protect yourself and the university from cyber threats like phishing attacks, viruses, and malware.
• Report a Cybersecurity Incident or Contact Us if you think your account has been compromised.

The process of creating or changing a password may take up to 15 minutes to propagate across all systems.

The CSU IT Security policy requires all NetID account holders to change their password once per year. Your password will expire one year after it was created or last changed.

The expiration date of your password is listed on these two pages:

• Select My Account > Show My Information. In the NetID Account section, look for Password Changed and Password Expires.
• Select My Account > Change Password. Under the Save button, look for Password Changed and Password Expires.

• Your account recovery email address is used to verify your identity and reset your password if you forget your password or CSU ID.
• It is required and must be a personal, permanent, non-CSU email address. (It cannot end with colostate.edu or csupueblo.edu.)
• You should not use an email address that will be expiring soon, such as your email address from your high school or previous college or university.
• You can have a maximum of 2 recovery emails. (To add a new one when you have two, you must delete an old one.)

To recover your password, follow these steps:

1. Select My Account > Recover Password from the top menu.
2. Enter your NetID and provide your non-CSU recovery email address.
3. Check the box next to "I'm not a robot" and click Send.
   An email will be sent to your non-CSU recovery email address.
4. Log in to your non-CSU recovery email account.
5. Open the email message from NetID@colostate.edu with the subject line NetID Account Recovery Request.
6. Click the link in the message, which starts with https://netid.colostate.edu/token.aspx?token=.
7. A new browser window or tab should open. Enter your NetID and click Continue.
8. Authenticate with Duo if prompted.
9. Review the password requirements, and enter and confirm your new password.
10. Click Save. Once you have successfully saved your new password, your account will be updated, and you should be able to access your account using the new password.

See the Contacts page for contact details.

CSU Fort Collins

• Student applicants and returning students should contact Admissions.
• Admitted students and former students who left CSU less than 12 months ago should contact the Registrar.
• Alumni and former students who need to access their personal records should use RAMrecords.
• Faculty, staff and associates should contact the Human Resources representative for their department.

Two-factor authentication makes your account more secure by requiring an additional piece of information beyond your username and password.

When you log in to some CSU systems, you will be required to validate your login credentials using a device you possess.

• Use the Duo Mobile app on your smartphone or tablet (recommended).
• Use a YubiKey security key.
• Generate a six-digit key from a hardware token.
• Receive a call from a phone you registered (deprecated and likely to be discontinued for security reasons).

• Microsoft 365 applications (OneDrive, Teams, etc.) and university email accounts
  • Required for all students, faculty and staff
• CSU VPN services for secure off-campus access to CSU resources
  • GlobalProtect web interface: CSU Fort Collins
  • GlobalProtect web interface: CSU Pueblo
  • GlobalProtect Agent: desktop client for PC or Mac, or mobile app for Android or iOS
• Kuali (Financials and Research)
• Duo is gradually being enabled on other systems throughout CSU.

You should set up two-factor authentication as soon as you have activated your NetID.

All CSU students, faculty, staff and associates must set up two-factor authentication for Microsoft 365 access.

Effective February 9, 2023, the Duo Mobile app will no longer support Android 8, Android 9, and iOS 13. Users will continue to be able to authenticate. However, no support or troubleshooting will be available if issues are encountered. We recommended users upgrade to the latest iOS or Android version.

For more information, see Duo Mobile App OS Support Changes

1. Download and install the Duo Mobile app from Duo Security LLC:
   •  Duo Mobile app for iPhone
   •  Duo Mobile app for Android
2. Log in to the NetID website. Click Login, select your campus, and enter your NetID and password.
3. Select Two-Factor Authentication (Duo) from the My Account menu.
4. To register a YubiKey or other security key, use the Duo prompt instead of the Two-Factor Authentication page.
5. Click the Enable Two-Factor Authentication button to enable two-factor authentication on your NetID account.
6. Register and activate at least one device, preferably two.
   1. Click the + Register Device button.
   2. You should see the Register Device screen.
   3. Device Name: Enter a description that will help you recognize the device, such as cellphone, tablet, or my Samsung Galaxy S21.
   4. Phone Number: Enter the 10-digit phone number of the device, if any. Leave blank for a tablet.
   5. Type: Select the type of authentication you would like to use. Duo Mobile App is recommended.
      Phone calls are deprecated and likely to be discontinued for security reasons. For a landline, you must use phone call.
   6. Platform: Select the operating system of your device (such as Apple iOS or Google Android).
      If you are not using the Duo Mobile app, select Generic Phone or Landline.
   7. Click Save. If you are using the Duo Mobile app, you will see the Two-Factor Device Activation screen with a QR code.
   Then on your device,
   1. Open the Duo Mobile app.
   2. Select Set Up Account, or the  or  Add icon in the top right if you already have a Duo authentication with another entity.
   3. Select Use QR Code in your device.
   4. Use your device to scan the QR code on the webpage. Your device will be automatically connected with the NetID application.
   5. On the Name Account screen, modify the Account name if desired, and tap Save.
   6. On the webpage, click the Return link. Your device will appear at the bottom of the list of registered devices.
7. Register a second device.

   You are encouraged to have a second device such as a YubiKey or hardware token registered at all times, to prevent being locked out of your account in case your primary device is lost or unusable.

1. Click Log Out if you are logged in.
2. Click Login, select your campus, and log in again with your NetID if prompted.
3. You will be prompted for two-factor authentication with Duo.
4. On your device, look for a login request from Colorado State University with text "Are you logging in to Web SDK - NetID Self-Service?".
5. Tap Approve. You will then see the Approved screen and will be logged in to the NetID website.

A YubiKey is a small hardware device used for quick and easy two-factor authentication by simply touching it.

YubiKeys are available online from the Yubico store, Amazon, Walmart, etc.

Duo requires FIDO2/WebAuthn-compatible YubiKeys. All new YubiKey models are compatible.

Compare YubiKey prices and features for use with your devices.

• Communication support: USB-A, USB-C, iOS Lightning, NFC
• Form factor: regular or nano
• Compatibility with other applications, if desired (Google, Microsoft, Windows, MacOS, password managers, etc.)
  (For example, LastPass is compatible with the YubiKey 5 Series but not the cheaper Security Key Series)
• Advanced: FIPS, biometric (fingerprint recognition)

1. Insert your YubiKey into a USB port of your computer or phone.
2. Log in to the NetID website.
3. On the Duo prompt screen, click the Other options link at the bottom.
4. On the Other options to log in menu, click the Manage devices option below the login options.
5. On the Verify your identity before managing devices menu, click an existing device (such as Duo Push if you registered your mobile device) and complete Duo authentication.
6. On the device management portal, select Add a device to the right of your existing devices.
7. On the Select an option pop-up menu, select Security key.
8. On the Security key pop-up window, select Continue.
9. On the Continue setup pop-up window, tap on the metal circle of the security key to enter your security key pin and click Continue.
10. Repeat on another Continue setup pop-up window.
11. On the Added security key pop-up window, click Continue.
12. You will receive an email message with this information.

    From: Duo Security <no-reply@duosecurity.com>
    To: your CSU First.Last@colostate.edu email address
    Subject: Device (Passkey or Security key) added
    Body: … Duo noticed a device (Passkey or Security key) was recently added to your account. If this was you, no further action is needed. … Duo will notify you when changes have been made to your devices to protect your account from unauthorized activity. …

13. If desired, click the Edit link (pencil icon) in the Passkey window, enter a Device name on the Rename Passkey pop-up window and click Rename.
14. Click the Back to Login → link in the top right.
15. When prompted to log in, select your security key. (The device you select to log in becomes the default device for your next login to the application.)

1. Purchase a YubiKey and register it with CSU Duo.
2. Insert your YubiKey into a USB port of your computer or phone.
3. Log in to the NetID website.
4. On the Duo prompt screen, if your default option is not security key, click the Other options link.
5. On the Other options menu, click Security key.
6. If you see a Choose a passkey for duosecurity.com window, click Use an external security key.
7. You will see the Use Security Key pop-up window, or a Making sure it's you Touch your security key pop-up window.
   
8. Touch the button (lighted metal contact) on your YubiKey to authenticate.

Note that YubiKeys currently do not work with GlobalProtect unless you are using Linux and use the System Default Browser.

YubiKeys must be added from the Duo prompt (and not the Two Factor Authentication page).

• If you see a Choose a passkey for duosecurity.com window,
  1. Check the Two Factor Authentication page. If your YubiKey is registered with a Label of Passkey, it will prompt to use your YubiKey as a passkey. Chrome or Edge may have registered it as a passkey.
  2. In the Duo prompt, manage your devices, and edit and delete your YubiKey.
  3. Register your a different browser such as Firefox, which may register the YubiKey as a Security key.
  4. Log out and log in again to see if the issue is resolved.
• If you see more than one Windows Security popup window,
  1. Check if Bluetooth is enabled on your device and used by multiple devices including the YubiKey.
  2. If so, and you do not currently need Bluetooth for connecting to external devices, try disabling Bluetooth in your device settings.
  3. Log out and log in again to see if the issue is resolved.

A hardware token is a small device used to generate a one-time passcode for two-factor authentication.

1. CSU Fort Collins: Buy a Duo D100 hardware token at RAMtech in the Lory Student Center for $23.75 and the staff will register the token for you.
2. CSU Pueblo: Hardware tokens are not currently supported.
3. Log in to the NetID website.
4. On the Duo prompt screen, if the default option is not hardware token, click Cancel if necessary, and click the Other options link.
5. Select Hardware token.
6. Press the button on your hardware token to generate a new six-digit passcode.
7. Type the passcode into the Passcode field and click the Verify button to authenticate.

If your phone is already in the Registered Devices list, you do not need to add it again.

If you have created a Duo account with both your CSU eID and CSU System NetID, and both accounts use the same phone number, choose one of these workarounds:

• If you have not registered any other devices, log out and log in again, and follow the instructions for registering a device if none are registered.
• If you will only be logging in with this device using Duo "Send Me a Push" and not a phone call, you can leave the phone number blank.
• If you must include a phone number, you could enter an arbitrary number in the optional Extension field.
  (An extension is one or more extra digits normally used to connect to an internal phone of a business or organization.
  A fake extension, such as 99, would be ignored by most phones, and the combination of phone number plus extension would be unique for Duo purposes.)
• If you are no longer using the device for Duo login with CSU NetID, remove the device from the Two-Factor Authentication (Duo) page.

The Duo Universal Prompt guide states that the last device you used for each application will be the default for your next login.

1. Log in to the NetID website.
2. On the Duo prompt screen, click the Other options at the bottom. (If your default option is security key, you may have to click Cancel to access the link.)
3. Select your preferred login method.

Contact us so that a CSU Division of IT Duo administrator can verify your identity and either reset your Duo account status or remove all your registered devices and you can start over.

• CSU Division of IT: Duo Two-Factor Authentication
• CSU Division of IT: GlobalProtect VPN

Your email alias is your public CSU email address, which is created when your CSU email account is set up.

The formatting requirements for your email alias are as follows:

• It includes your first and last name.
• Your first name can be your legal first name, preferred first name (nickname), or any other name like your middle name, First.Middle, or First.MiddleInitial.
• Your last name can be your legal or professional/preferred last name.
• The allowed characters in the email alias are: A-Z, a-z, underscore (_), hyphen (-), and period (.)

The most common formats for email aliases are:

• First.Last@colostate.edu (for CSU Fort Collins staff and students)
• First.Last@rams.colostate.edu (for CSU Fort Collins students before 2018 - Gmail)
• first.last@csupueblo.edu (for CSU Pueblo staff and students starting from May 2022)
• fm.last@pack.csupueblo.edu (for CSU Pueblo students before May 2022)

To view and change your email alias after activating your NetID, follow these steps:

1. Select My Account > Email Alias.
2. Choose your CSU Email First Name from the menu. Your options will include your legal and preferred first name, middle name, and/or initials. If your preference is not listed, select Other (please specify) and enter a different name.
3. Choose your CSU Email Last Name from the menu. If you are a CSU employee with a professional or preferred last name, you can choose this option instead of your legal last name; otherwise this menu will be disabled.
4. Select your CSU Email Domain if you are affiliated at more than one CSU campus or your campus is not already selected. (Choose colostate.edu for Fort Collins or csupueblo.edu for Pueblo.)
5. Verify that the New Email Address displays the email address you wish to use.
6. Click Save to save the changes.

The process of creating or changing an email account or address may take up to 2 hours to propagate across all systems.

Messages sent to your old email alias will continue to be delivered to your inbox until the old email alias expires after 6 months.

Once it expires, any messages sent to it will be returned as "undeliverable" unless the alias is taken by someone else.

To prevent losing emails from important contacts, you may want to inform them that your email address has changed.

To determine who is still sending to your old address, you can automatically copy the message to a folder you create.

1. Log in to Microsoft 365.
2. Create a folder to hold copies of the messages.
3. Go to Settings, Mail, Rules, + Add new rule.
4. Add a condition Message header includes and enter the old alias.
5. Add an action Copy to and select the folder. Click Save.
6. Test by sending a message from a non-CSU email account to the old alias.

In Outlook for Windows, you can create a rule to send an automatic message to inform the sender of your old and new email address.

1. Right-click any message and click Rules, Create Rule...
2. Click Advanced Options...
3. Check with specific words in the message header.
4. Click the specific words link in step 2.
5. Enter your old email alias, click Add and clik OK. Click Next.
6. For the action, check have server reply using a specific message.
7. Click the specific message link in step 2.
8. Enter the subject and message, and click Save & Close. Click Finish.
9. Test by sending a message from a non-CSU email account to the old alias.

No, the change in your email alias will not affect how you log in to your existing Microsoft 365 account. You will continue to use your NetID@colostate.edu as your username and your NetID password to log in. There will not be a second email account created.

Your email alias will automatically appear in in systems such as Microsoft 365 (Outlook, Teams, etc.), Gmail, the CSU Online Directory, Canvas, and many other systems at CSU.

Your deliverable email address is your NetID@colostate.edu.

The deliverable address refers to the internal name for the location on a mail server where your emails are stored. It is the actual address to which emails sent to your email alias are delivered.

Your deliverable address is also used as your Microsoft 365 account login and User Principal Name (UPN) in Microsoft Windows Active Directory.

The choice is yours. You can keep both accounts while at CSU, though you can't switch your primary email alias from Microsoft 365 back to Gmail. For more information, see Email Accounts and @RAMS Accounts.

For more information about email accounts and login specific to your campus, please refer to the Email Login and Help page.

You may want to use preferred first and last names that are different from your legal names.

For example, many people have nicknames, and someone with hyphenated last names may want only one of the last names displayed.

The CSU Online Directory, Outlook Address Book, and many other services at CSU have been customized to display your preferred names.

For examples of student systems at CSU Fort Collins that use preferred first name, see Change My Information: Preferred First Name vs. Legal Name Usage (CSU Office of the Registrar).

1. Go to View/Update > Preferred First Name.
2. Update your preferred first name and click Save.

CSU Fort Collins Employees

• Employees can update their preferred last name in the Human Resources Portal, CSU Employee Self-Service under Personal Information, Basic Details. (To access this link, you need to be on campus or log in through the CSU GlobalProtect VPN.)
• Employees can also email Human Resources Information Systems (HR IS) to request a preferred last name.

• Students: Contact the Office of the Registrar.
• Faculty/Staff/Associates: Contact your hiring/onboarding Departmental HR Representative.

View your information in the CSU Fort Collins Online Directory.

Students

As part of the Family Educational Rights and Privacy Act (FERPA), CSU Fort Collins students have the option to exclude your email address from the University's public online directory.

Opting out means that your family, friends or others searching for your email address will not be able to locate it though the online directory.

Your email address (just like your postal mail address) will be available to University personnel to keep you informed regardless of your FERPA selection.

Change your privacy settings in RAMweb

Learn more about FERPA and Student Privacy

Faculty and Staff

Faculty and staff are public employees and are required to be in the directory.

Associates

Associates are not in the directory by default. To be included the directory, contact your Human Resources liaison (who can log in to the Oracle HR system and update the Include Associate in Directory field).

Personal Pronouns can be added to RAMweb, the CSU Fort Collins Student, Faculty, and Staff Directory, and Microsoft 365.

A NetID service account is a CSU NetID that is owned by a department.

Most service accounts include a Microsoft 365 account (including Outlook for email, OneDrive for cloud storage, and other Microsoft Office applications), but some do not, including administrative service accounts.

A NetID service account can be used by one CSU faculty and staff member, or multiple faculty and staff by securely sharing the username and password if necessary.

Common uses include:

• A central email address for shared contact and support (for a department, unit or website). (Consider a shared mailbox for this purpose if this is the only requirement.)
• An email account with a short email address (such as depthelp@colostate.edu) that the owner might want to configure to serve as an alias and automatically forward all mail to a shared mailbox with a longer email address (such as dept_helpdesk@colostate.edu) so the service account password does not need to be shared.
• A secondary inbox for a single person to receive emails for specific purposes, such as a secondary job role or large student documents.
• Group access to CSU lab or facility resources where authentication from multiple individual CSU user accounts is not feasible or practical.
• Short-term access for non-CSU partners (e.g. training, conference or workshop attendees who need to be contacted via CSU email, or would be too constrained by the csu-guest Wi-Fi, and guest speakers who need to use computer labs). The password should be updated after each use.
• A true service account: a non-personal digital identity for machine-to-machine communication, application and data access, and running batch jobs, scripts or automated services.
• IT, PC, software or web development testing or logging.

Service accounts are subject to the CSU Information Technology policies, including Acceptable Use for Computing and Networking Resources and Information Technology Security.

You do not need a service account if you only need a shared mailbox or mailing list for your unit.

1. Review information about CSU Microsoft 365 resource management including:
   • shared mailboxes
   • email aliases
   • mailing lists
2. Look up and contact the CSU Microsoft 365/Exchange Resource Coordinator for your department.

You do not need a service account if you only need to share documents and files within your unit. Some options include:

Shared Drives

• Microsoft 365 at CSU: OneDrive for Business (5 TB, can be extended): Share and Collaborate with OneDrive
• Google Workspace for Education at CSU: Google Drive (just 25 GB): Share files and other content with a group

Collaboration Tools and Websites

• Microsoft Teams at CSU: File Sharing
• Microsoft SharePoint sites at CSU
• Google Sites

Service accounts can function for basic testing of single sign-on.

However, by default an LDAP record is not created, so no LDAP entitlements or other attributes are released to applications, and many systems rely on CSU ID for access.

Only a small number of service accounts have an LDAP record. They have been created for testing purposes or administrative accounts for automated services, and they a very limited set of test attributes.

A primary NetID account is generally needed to test attribute release and group- or role-based authorization in a Shibboleth-protected web application.

A shared account that can access many CSU resources is a security issue.

Service account users and administrators must be CSU Fort Collins faculty or staff members.

CSU Microsoft 365/Exchange Resource Coordinators should submit service account requests on behalf of CSU faculty and staff members.

Multiple people can manage a service account. Administrators for each service account are members in a service account Grouper group.

Service accounts should only be used by CSU faculty and staff.

If an account is needed for others, request a guest associate NetID from your departmental Human Resources representative.

Additional information about associates from CSU Human Resources:

• Classification and Compentsation: Associates
• Human Resource Management System User Guide: Unit 12: Associates

Although one or more individual faculty and staff members can use and manage a service account, each service account is associated with and owned by a department.

This assures that new administrators can be easily assigned to the service account in Grouper when the previous administrator departs.

All existing secondary NetIDs (formerly called secondary eIDs) that were requested for migration in 2022, and all active secondary NetIDs created after July 2022, were migrated to NetID service accounts on May 31, 2023.

To list service accounts you manage, go to My Account > Service Accounts.

To double-check that your service accounts have been added in Grouper, Log in to Grouper (requires CSU GlobalProtect VPN login to access from off campus), click My Groups and filter for Service_Accounts if necessary.

If one of your secondary NetIDs is missing, please contact us to determine the current status and have it migrated if necessary.

Details of service accounts including your access to the existing email account did not change during the transition.

You can use the Service Accounts page to view details of each service account, change the password, and manage the service account administrators. (Service account administrators can also be managed in Grouper.)

Secondary NetIDs that you did not select for migration to a service account were unavailable for password changes starting May 24, 2023 and were automatically deactivated on October 2, 2023.

Secondary NetIDs are no longer in the WEID_DIR_PERSON_00 Banner database table since the table was replaced by a view during the NetID migration in July.

Current service account data is available to NetID administrators and service account requesters in the Admin menu on the Service Accounts page.

Copy the following table and paste into an email message to a Service Account Requester or CSU Microsoft 365/Exchange Resource Coordinator for your department or unit:

Copy to Clipboard

2-8 lowercase letters (a-z) and digits (0-9), starting with a letter.

Not allowed: Uppercase letters, spaces, underscores, hyphens, accents, special characters

If your unit needs an email address with more than 8 characters, contact your CSU Microsoft 365/Exchange Resource Coordinator to request a shared mailbox.

Service accounts do not have a regular CSU ID because they are owned by a department and not an individual.
(This makes it easy to add and remove service account administrators in Grouper.)

The CSU ID of the initial administrator is stored for administrative purposes only.
(Also, a 9-digit number starting with 2 is generated as an identifier for applications that require a CSU ID.)

Thank you for considering deactivating your unused accounts to benefit yourself, CSU, and the environment.

1. If the service account has more than one administrator or user, or the associated email address was recently used, communicate the change and make sure that nobody still needs access.
2. Back up and/or transfer any needed information from the Microsoft 365 account.
3. Contact the CSU IT Help Desk to request deactivation of the service account.
4. The Microsoft 365 account will be deactivated when the service account is deactivated and permanently removed 30 days later.

1. Click Login, select your campus, and log in with your primary NetID.
2. To list service accounts you manage, go to My Account > Service Accounts.
3. To manage or view full details of a service account, click the Service Account NetID in the left column of the table.
4. To update details of the service account, change editable fields Account Name and Account Description and click Save. (Other details can only be updated by NetID full admins.)
5. To change the password, click Change Password and see instructions below.
6. To view or change the service account's administrators, click Manage Admins and see instructions below.

1. If you are not the only administrator of the service account, communicate with the other administrators to determine who will create and share the new password.
2. Click Login, select your campus, and log in with your primary NetID.
3. Go to My Account > Service Accounts.
4. Click the Service Account NetID in the left column of the table.
5. To change the password, click Change Password. You will be prompted for a new password for the service account.

Note: Only service account admins can change the password. (You cannot change the password by logging in to the NetID website with your service account NetID and password.)

CSU System's IT Security Policy requires annual password changes for all NetID accounts, including non-administrative service accounts.

Weekly email notifications from netid@colostate.edu will be sent to the service account and all admins. The message will include the service account password expiration date.

Expired service account passwords will be automatically reset a week after the expiration date (or a week after the first notification is sent, whichever is later).

Share passwords verbally (in person or by phone), through encrypted email, or through a password manager.

Unencrypted email, SMS text messages, plain text files, and instant messengers generally are not secure ways to share passwords.

Consider adding at least one person or group to serve as a secondary or backup administrator, such as your department's IT administrator or group, CSU Microsoft 365/Exchange Resource Coordinator or group, or department head.

1. Click Login, select your campus, and log in with your primary NetID.
2. Go to My Account > Service Accounts.
3. Click the Service Account NetID in the left column of the table to view the service account details.
4. Click Manage Admins to view the service account admins.
   • To add an admin, type the person's NetID in the NetID of New Admin field and click Add Admin.
   • To add an IT admin group, select the group in the IT Admin Group drop-down list and click Add IT Admin Group.
   • To add a Microsoft 365/Exchange Resource Coordinator group, select the group in the Microsoft 365/Exchange Resource Coordinator drop-down list and click Add MS365 RC Group.
   • To remove admins, check one or more boxes in the Current Admins list and click Remove Selected Admins.

You can also edit the service account admins directly in the Grouper group (e.g. to add an unlisted group).

1. Click Manage Admins in the Grouper section.
2. You will log in to Grouper and view the service account group.
   • All group members listed under the Members tab are administrators of the service account.
   • To add an admin, click the + Add Members button. Type the person's NetID in the Member name or ID: field. Click the person's name when it appears below the field. Click Add.
   • To add an entire group of Resource Coordinators for your department, search for exchange_resource <department>, where <department> is the name or four-digit department number of your Resource Coordinator group.
     Resource Coordinator groups are in the basis:sqlprod:exchange_resource folder. (The group name is a number.)
     For multiple results, mouse over the name of each result to find the correct group and primary Resource Coordinator (RC).
   • To remove an admin, find the person's name under Entity name and select Revoke membership from the Actions menu to the right. You should not remove yourself until after you have added another member.

Grouper is a web-based tool for creating, viewing and managing groups, members, roles and permissions. These groups are used to authorize access to NetID service accounts and many other CSU online applications.

For more information, see Grouper at CSU (requires CSU GlobalProtect VPN login to access from off campus).

To add or remove group members, see instructions for Grouper Group Management (PDF).

Lightweight Directory Access Protocol (LDAP) is a directory of user information which applications use during authentication (login) and authorization (allowing access).

An LDAP entitlement is a value in a person's LDAP record that applications use to determine whether a person is authorized to access an application and its features.

Grouper groups can add entitlement attributes to LDAP records. After single sign-on, Shibboleth releases LDAP attributes to applications.

NetID admins can see a person's entitlements at Person Admin > LDAP:
https://netid.colostate.edu/admin/ldap.aspx?netid=<netid> (where <netid> is a person's NetID)

The NetID system assigns roles and permissions based on LDAP entitlements that begin with https://colostate.edu/netid/.
(Note: Although these attributes are formatted as URLs, they are not web addresses.)

Examples of NetID LDAP entitlements

NetID Role	LDAP Entitlement
NetID Read-Only Admin	https://colostate.edu/netid/readonly/admin
NetID Help Desk Admin	https://colostate.edu/netid/helpdesk/admin
NetID Partial Admin	https://colostate.edu/netid/partial/admin
NetID Admin Requester	https://colostate.edu/netid/admin/requester
NetID Service Account Requester	https://colostate.edu/netid/serviceaccount/requester
NetID Service Account Admin	https://colostate.edu/netid/svc_acct/<netid> (where <netid> is a service account NetID)

NetID admins and service account requesters can view a list of all service accounts at Admin > Service Accounts.

NetID service account requesters can also view their own service account requests, and edit their requests that have not yet been processed (with status "requested").

NetID service account administrators can view the individual service accounts they manage at My Account > Service Accounts.

This feature is not currently implemented, but it would increase security, so it is being considered for development.

1. Go to Microsoft 365.
2. Sign in with your service account NetID and domain (netid@colostate.edu) and your service account password.

Review the presentation slides from the Open Forum on NetID Service Accounts (PDF, May 24, 2023).

Watch the Microsoft Stream recording (requires NetID login).

NetID administrators are CSU faculty and staff whose job duties require them to support other CSU faculty, staff and students in using the NetID website, including to activate their NetID, change or recover their NetID password, and view and change their information.

For more information and instructions, including requesting NetID admin access, CSU faculty and staff can view the NetID Admin FAQ after logging in with their NetID.