In short: Duo Authentication for macOS adds Duo MFA to local Mac console logins and, from version 3.0.0 on macOS 14 or later, to screen unlock and wake from sleep. It supports Duo Push, passcodes, hardware tokens and phone call, offers offline access with Duo Mobile passcodes, and runs on Apple silicon. Touch ID is not a supported factor.
What Duo for macOS protects
Duo for macOS is a login plugin. After the user enters their Mac password, Duo asks for a second factor before the desktop opens. From version 3.0.0 on macOS 14 or later, Duo is also required by default when unlocking the screensaver and when a logged-in user wakes the Mac from sleep; this behaviour can be adjusted.
It protects local console logins only. Remote SSH to a Mac is not covered; for that, Duo points to Duo Unix. The plugin does not support inline self-enrolment, so users must be enrolled in Duo before their first Duo-protected login, and their Duo usernames must match the macOS account username. Agree a naming convention and enrol users (by bulk enrolment or directory sync) before rollout.
This page is about login MFA. Checking a Mac's health (encryption, firewall, OS version) before it reaches your apps is a separate job done by Duo Desktop, covered under device trust. Many organisations deploy both.
Supported macOS versions
| macOS version | First supported in Duo for macOS |
|---|---|
| macOS 27 | 3.0.1 |
| macOS 26 | 2.0.5 |
| macOS 15 and macOS 14 | 2.0.2 |
| macOS 13 and earlier | No longer supported |
All Apple silicon (M-series) Macs are supported from version 2.0.5. Macs need outbound HTTPS to Duo on TCP 443 using TLS 1.3, and Duo advises against firewall rules based on its IP addresses. Duo updates this matrix as new macOS releases arrive, so check the current Duo documentation before planning upgrades.
Authentication factors and offline access
Users can approve with Duo Push, Duo Mobile passcodes, SMS passcodes, hardware token passcodes, phone call or bypass codes, depending on your policy. An optional auto-push setting sends a push or phone call automatically. Touch ID is not a valid factor for Duo Mac logon, even though Macs have it built in.
Offline access lets users log in when the Mac cannot reach Duo:
- The only offline method is a passcode from Duo Mobile; security keys are not supported offline
- Only one offline authenticator device can be active per user; activating a second deactivates the first
- Users can also be offered an offline code when unlocking an existing session, as well as at login
- Admins can limit offline use to a number of logins or a number of days (up to 365)
- Once any user on a Mac has set up offline access, users who have not are blocked when offline, even if the Mac is set to fail open
- Offline logins are recorded locally and reported to Duo next time the Mac is online
Deployment, fail mode and macOS upgrades
Duo provides a configuration script that builds a ready-configured installer package containing the macOS application's integration key, secret key and API hostname, plus your fail mode, auto-push and unlock options. The result is a standard macOS installer package, which can be installed on a single Mac or distributed with the Mac management tool you already use. Duo's own guide covers the package rather than any particular MDM, so we test distribution on a pilot group first.
- Other login plugins: before installing, check that any other authorisation plugins on the Mac support Swift 5, or users may be unable to log in
- Fail mode: by default Duo for macOS fails closed, blocking logons if Duo cannot be reached. Failing open allows logon without MFA in that case; decide deliberately
- Recovery protection: Duo recommends setting a firmware password so Duo cannot be disabled through recovery mode
- macOS upgrades: a macOS upgrade can disable the Duo login package. Duo supplies a restore package to put it back. Test each major macOS release on a pilot group first and use your MDM to time upgrades
- Uninstalling: use the uninstaller package supplied by Duo, and do not delete the macOS application in the Admin Panel until Macs have been uninstalled
Keep a local admin account and its recovery process documented, so a help desk can recover a Mac whose user has lost their phone.
Who it suits
Duo for macOS suits organisations with Mac users who handle sensitive data, design and creative teams, schools with staff MacBooks, and mixed Windows and Mac estates that want the same MFA experience on both. Pair it with Duo for Windows Logon for Windows machines, and with Duo Passwordless and Duo Single Sign-On for the apps users open once they are logged in.
Login MFA on laptops also helps answer cyber insurance and audit questions about protecting devices that leave the office; see MFA for cyber insurance.
How we help
We build and sign off the configured package, deploy it through your MDM, plan fail mode and offline settings, test against the current macOS release and write the user and help desk guides. Contact us to add Duo to your Macs.
How Forever Systems supplies and supports Cisco Duo
We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.
- Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
- Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
- Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
- Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
- Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Duo quote, trial or roll-out plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Duo work on Mac login?
Yes. Duo Authentication for macOS adds Duo MFA to local Mac logins and, from version 3.0.0 on macOS 14 or later, to screen unlock and wake from sleep. It supports macOS 14 and later and all Apple silicon Macs.
Can I use Touch ID with Duo for macOS?
No. Touch ID is not a supported factor for Duo Mac logon. Users can approve with Duo Push, Duo Mobile passcodes, hardware token passcodes, SMS, phone call or bypass codes.
Does Duo for macOS work offline?
Yes. With offline access, users can log in with a Duo Mobile passcode when the Mac cannot reach Duo. Security keys are not supported offline, and once one user on a Mac sets up offline access, users who have not are blocked when offline.
Why did Duo stop working after a macOS upgrade?
A macOS upgrade can disable the Duo login package. Duo supplies a restore package in the download to re-enable it. Test new macOS releases on a pilot group and keep Duo on a current version before users upgrade.
Can Duo for macOS be deployed to many Macs at once?
Yes. Duo's configuration script builds a pre-configured macOS installer package containing your application keys and settings, which can be distributed with your existing Mac management tool. Duo's guide documents the package rather than a specific MDM, so test distribution with a pilot group first.