a few more 2 factor authentication questions

["Schnitzer, Lawrence" <lps () BUFFALO EDU>]

We're in the infancy of rolling out Duo for 2-factor at the University at Buffalo and are pondering policies.  I'm 
wondering what other edu's are doing for the following:

  *   For the systems that use 2-factor (once we install it on shibboleth that will be most of our systems) is it 
mandatory for all faculty, staff, and students?  Maybe an opt-in approach?
  *   If you auto enroll everybody is there an opt out process?
  *   Do you require 2-factor regardless of a user's location?  (It's been suggested that we don't require from on 
campus networks.)
  *   How often do you require 2-factor?  Every login?  Once per day or week, etc....

Thanks.

-Larry

--
Larry Schnitzer
Director
Enterprise Infrastructure Services
University at Buffalo