In short: Cisco Duo integrations connect Duo's MFA and access policies to the systems users sign in to: Microsoft 365 and Entra ID, Google Workspace, AWS and other SAML or OIDC apps, Windows and macOS logon, Linux SSH, VPNs and firewalls, Microsoft RD Gateway, and on-premises RADIUS or LDAP systems through the Duo Authentication Proxy.
How Duo integrations work
Every system you protect is added in the Duo Admin Panel as an application. Non-SSO applications get their own credentials: a Client ID and Client secret (still shown as the integration key and secret key on applications without Universal Prompt support), used together with your account's API hostname. You then connect the system to Duo in one of four ways:
| Integration pattern | How it works | Typical examples |
|---|---|---|
| Single sign-on (SAML 2.0 or OIDC) | Duo acts as the identity provider. Users are redirected to Duo, sign in and complete MFA, then return to the app | Microsoft 365, Google Workspace, AWS, Salesforce, Slack, Zoom |
| Duo software on the system | A Duo plugin or agent runs on the computer or server and prompts during logon | Windows Logon and RDP, macOS logon, Duo Unix for SSH, RD Gateway and RD Web |
| Proxy (RADIUS or LDAP) | The Duo Authentication Proxy sits between a device and your directory, checks the password, then asks Duo for the second factor | VPNs, firewalls, network devices, virtual desktop gateways, older on-premises apps |
| APIs and SDKs | Your developers call Duo directly from your own software | In-house web apps, customer portals, automation through the Admin API |
Wherever Duo shows a browser-based prompt, users see the Universal Prompt, Duo's current login screen. Duo ended support for the older traditional prompt for most applications on 30 March 2024, so any integration still configured for it should be updated.
Cloud, SaaS and identity providers
Most cloud services are protected through Duo Single Sign-On, Duo's cloud identity provider, which is included from Duo Essentials. Duo's documentation lists hundreds of pre-built SSO applications, plus generic SAML, OIDC and OAuth options for anything not on the list.
- Microsoft 365 and Entra ID: the Microsoft Entra ID: External MFA application, or Duo SSO federation for your Microsoft 365 domain
- Google Workspace: Duo SSO as the SAML identity provider for Gmail, Drive and the rest of Workspace
- AWS: Duo SSO for AWS IAM Identity Center or for direct AWS IAM role federation, plus SSH to Linux instances
- Other identity providers: Duo's documentation covers adding Duo MFA to existing identity platforms such as Okta, OneLogin, PingFederate, Shibboleth and Microsoft AD FS
- Authentication sources: Duo SSO checks passwords against Active Directory (through the Duo Authentication Proxy), a SAML identity provider such as Entra ID or Google Workspace, or users held in Duo Directory
Operating system logon
Duo can ask for a second factor before anyone gets to a desktop, which matters for laptops that leave the building and for servers that admins reach over remote desktop.
- Windows Logon and RDP: local and remote desktop logons on Windows 10, Windows 11 and Windows Server, with offline access and passwordless logon options
- macOS logon: console logins, screen unlock and wake from sleep on supported macOS versions
- Linux and Unix: Duo Unix adds MFA to SSH and local logins through an open-source PAM module, which Duo has tested on Red Hat, Fedora, CentOS, Debian, Ubuntu and Amazon Linux as well as BSD, Solaris and AIX
These are separate from Duo Desktop, the app that checks device health and registers trusted devices. Logon protection and device checks are often deployed together.
Remote access, VPNs and virtual desktops
Remote access is where stolen passwords do the most damage, so it is usually the first thing to protect.
- VPNs and firewalls: Duo's documentation covers Fortinet, Palo Alto Networks GlobalProtect, Check Point, Juniper, F5 BIG-IP, OpenVPN and others, using SAML, OIDC, RADIUS or LDAP depending on the product
- Cisco Secure Client (formerly AnyConnect) on Cisco ASA and Secure Firewall Threat Defense
- Microsoft RD Gateway and RD Web for remote desktop services
- NetScaler (formerly Citrix Gateway) through Duo SSO or RADIUS, and Citrix Workspace through Duo SSO
- VMware Horizon virtual desktops (now an Omnissa product) through RADIUS and the Authentication Proxy; Duo's documentation still lists it as VMware Horizon View
- VPN-less access: Duo Network Gateway, included in Duo Premier, publishes internal web apps, SSH and RDP without a VPN client
On-premises systems and APIs
Plenty of important systems pre-date modern single sign-on. If a system can authenticate users over RADIUS or LDAP, the Duo Authentication Proxy can usually add Duo to it without changing the system itself. The same proxy also handles Active Directory sync and AD password checks for Duo SSO.
For software you build yourself, Duo offers the Duo Web SDK (version 4 uses an OIDC-based flow with the Universal Prompt) to add MFA to your own login pages, the Auth API for adding Duo to custom applications, and the Admin API for automating user, group and reporting tasks. Duo deprecated its separate Accounts API in June 2026 and moved existing integrations to the Admin API, which now covers managed service providers' sub-accounts.
Choosing the right integration and edition
When a system supports more than one method, we normally recommend this order of preference:
- SAML or OIDC through Duo SSO: users get the Universal Prompt, every factor including passkeys and security keys, and device policies
- Duo's own plugin or agent for logons that SSO cannot reach, such as Windows, macOS and RD Gateway
- RADIUS or LDAP through the Authentication Proxy for devices and older apps that support nothing else
Duo Free covers MFA for teams of up to 10 users. Single sign-on, Duo Directory, Trusted Endpoints and unlimited applications start with Duo Essentials, and features such as risk-based policies and Windows command-line protection need Duo Advantage. The edition comparison shows where each feature sits, and our setup guide explains the order to roll integrations out in.
We map every system your users log in to, pick the right integration for each, build and test them with a pilot group, and document how each one fails safely if Duo cannot be reached. Contact us for a Duo integration review and a quote.
Popular Duo integrations
How Forever Systems supplies and supports Cisco Duo
We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.
- Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
- Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
- Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
- Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
- Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Duo quote, trial or roll-out plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What does Cisco Duo integrate with?
Duo works with most systems that users sign in to: Microsoft 365 and Entra ID, Google Workspace, AWS and hundreds of SaaS apps through Duo SSO, Windows and macOS logon, Linux SSH, VPNs and firewalls, Microsoft RD Gateway, virtual desktops, and on-premises systems that use RADIUS or LDAP.
Does Duo work with on-premises applications?
Yes. On-premises systems that authenticate over RADIUS or LDAP can be protected through the Duo Authentication Proxy, internal web apps that support SAML or OIDC can use Duo SSO, and on Duo Premier, Duo Network Gateway can publish internal web apps, SSH and RDP without a VPN.
Is there a limit on how many applications Duo can protect?
Duo Essentials, Advantage and Premier include unlimited applications. Duo Free is designed for small teams and has a narrower feature set, so check the current Duo Free terms if you plan to protect many systems.
What is the difference between a Duo SSO integration and a RADIUS integration?
With SSO, users are redirected to Duo's web-based Universal Prompt, which supports every factor and device check. With RADIUS, a device passes the login to the Duo Authentication Proxy, which usually limits users to Duo Push, phone call or passcodes. SSO is the better choice where both are available.
Can Duo protect custom or in-house software?
Yes. Duo's Web SDK and Auth API let developers add Duo to their own login pages, and the generic SAML and OIDC applications in Duo SSO can protect in-house apps that already support those standards. The Admin API automates user, group and reporting tasks.