In short: Duo Desktop, formerly called Duo Device Health, is Cisco Duo's app for Windows, macOS and Linux. It reports device security such as firewall, disk encryption, system password and OS version, registers devices using TPM 2.0 or Secure Enclave, and enables Trusted Endpoints, Duo Passport and same-device approval. What it can enforce depends on your Duo edition.
What is Duo Desktop?
A web browser can tell Duo very little about the computer it runs on. Duo Desktop is a native application that fills the gap: it sits quietly on the device and, when a user signs in to a Duo-protected application, gives Duo a trustworthy picture of the computer's identity and security.
It used to be called the Duo Device Health app, and you will still see that name in older guides. Duo Desktop is the foundation for device trust, for Duo Passport and for some passwordless and same-device sign-in options.
Supported platforms
| Platform | Supported versions (check Duo's matrix before deploying) |
|---|---|
| Windows | Windows 10 (build 1803 and later) and Windows 11; Windows Server 2016 and later. Intel processors only, not ARM. Needs .NET Framework 4.7.2 or later |
| macOS | macOS 12 and later (not beta releases), running natively on Intel and Apple silicon |
| Linux | Debian 11 and 12; Ubuntu 22.04, 24.04 and 26.04 LTS; CentOS Stream 8 and 9; Red Hat Enterprise Linux 8 and 9. Not ARM |
| ChromeOS | Duo Desktop is not available, but some health checks can use Chrome Enterprise browser data instead |
Duo's support for Windows Server 2016 ends in January 2027, in line with Microsoft's own end of support, so plan upgrades for any servers still on it. On Windows and macOS, an updater service checks for new versions every few hours and installs them silently (administrators can turn this off before installation); Linux versions update through the system package manager.
What Duo Desktop checks and does
- Firewall: whether the operating system firewall is on
- Disk encryption: BitLocker on Windows, FileVault on macOS, LUKS on Linux
- System password: whether the device has a login password
- Operating system version: the real Windows build and macOS version, which browsers often report inaccurately
- Security agents: whether a supported endpoint protection product is installed and running (Premier)
- Device registration: binding the device identity to its TPM 2.0 chip or Secure Enclave, so the identity cannot be copied to another machine
- Trusted Endpoints: reporting identifiers so Duo can match the device to Intune, Jamf or another management tool
Duo Desktop also supports Duo Desktop authentication: approving a login on the same computer, without a phone. It is available from Duo Essentials and needs Duo Desktop 6.12.0 or later on Windows 10 (build 1803 or later) or macOS 12 or later, TPM 2.0 or a Secure Enclave, and the Universal Prompt. Duo recommends it only where no other method is available, for example staff who cannot use a personal phone, and notes that a separate device such as a security key is more secure. It cannot start remembered-device sessions or work with Passport, and if it is a user's only method they cannot sign in from a different computer unless shared device authentication is enabled.
What Duo Desktop does in each edition
| Edition | What you can do with Duo Desktop |
|---|---|
| Duo Essentials | Require the app, register devices, and use it for Trusted Endpoints |
| Duo Advantage | Adds device health checks (firewall, encryption, password, OS) and Duo Passport |
| Duo Premier | Adds security agent verification, checking that endpoint protection is running |
Duo Desktop is a Windows, macOS and Linux app. Phones are checked through Duo Mobile instead, and ChromeOS devices through Chrome Enterprise, so plan your policy for those devices separately rather than assuming the Duo Desktop rules cover them.
Deploying Duo Desktop
There are two ways to get Duo Desktop onto computers:
- User self-install: the Duo prompt offers a download when policy requires the app, or you email users a link. Fine for a pilot or small team.
- Managed deployment: Duo provides an MSI for Windows, a PKG for macOS, and DEB and RPM packages for Linux. Push them with the tools you already use, such as Microsoft Intune, Jamf, or Group Policy software installation.
For managed Macs, Duo provides a script that generates an app identity certificate or configuration profile to deploy alongside the app through your MDM. On Windows, an MSI option stops the app launching straight after install, and macOS and Linux have equivalents, which helps with silent roll-outs.
From version 7.21.0, users can opt out of error and usage data reporting, and administrators can set this centrally, which also hides the prompt from users.
How we help
We plan and run Duo Desktop roll-outs end to end: checking hardware for TPM 2.0 and Secure Enclave, packaging the app for Intune, Jamf or Group Policy, deploying the macOS certificate, setting device policies to report-only first, then tightening them once you have seen the results. We also write the user guidance so people know why the app is there.
Contact us to discuss device trust for your estate, or ask us for a quote if you need to move up to Advantage or Premier for health checks and Passport.
How Forever Systems supplies and supports Cisco Duo
We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.
- Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
- Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
- Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
- Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
- Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Duo quote, trial or roll-out plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Duo Desktop the same as Duo Device Health?
Yes. Duo Device Health was renamed Duo Desktop. It does the same job, with extra capabilities such as device registration and support for Duo Passport.
Does Duo Desktop work on Linux?
Yes. Duo Desktop supports Debian 11 and 12, Ubuntu 22.04, 24.04 and 26.04 LTS, CentOS Stream 8 and 9, and Red Hat Enterprise Linux 8 and 9, on non-ARM processors. Duo Passport is not yet available on Linux.
Does Duo Desktop run on Windows on ARM?
Not at the time of writing. Duo lists Windows support for Intel processors only, so check Duo's current documentation if you have ARM-based Windows laptops.
How do I deploy Duo Desktop to all our computers?
Use the Windows MSI, macOS PKG or Linux packages with your normal deployment tool, such as Intune, Jamf or Group Policy. For managed Macs, Duo also provides a script to generate an app identity certificate or profile to deploy through your MDM.
Do I need Duo Advantage to use Duo Desktop?
No. Duo Essentials can require Duo Desktop and use it for device registration and Trusted Endpoints. Health checks need Advantage, and security agent checks need Premier.