Cisco Duo for Microsoft 365 and Entra ID

In short: Cisco Duo protects Microsoft 365 in two current ways: the Microsoft Entra ID: External MFA application, which makes Duo a full MFA method inside Conditional Access and needs Entra ID P1 or P2, or Duo Single Sign-On federation of your Microsoft 365 domain. The older Conditional Access custom control is being retired by Microsoft.

Your three options at a glance

For most organisations already using Conditional Access, External MFA is the simplest route. Federation suits organisations that want Duo SSO, Duo's device policies and passwordless login to be the front door for Microsoft 365 and other apps alike.

Option 1: Microsoft Entra ID: External MFA

Microsoft previously called this feature External Authentication Methods (EAM). It left preview in early 2026 under the new name External MFA, and Duo renamed its application to Microsoft Entra ID: External MFA in March 2026. Applications created before then keep their original name.

How it is set up:

1. Create the Microsoft Entra ID: External MFA application in the Duo Admin Panel
2. Register Duo as an external method in the Entra admin centre using the Client ID, Discovery Endpoint and App ID shown in the Duo application, then grant admin consent
3. Target Duo at a pilot group, then use a Conditional Access policy that requires MFA
4. Users choose Duo at sign-in, complete the Universal Prompt (enrolling inline if they are new) and return to Microsoft

Because Microsoft treats Duo as a genuine MFA method, it satisfies Conditional Access policies that require MFA. In the Universal Prompt users can approve with passkeys, security keys, Duo Push or Verified Duo Push, depending on your Duo policy.

Points to plan for:

• Licensing: every user signing in with Duo needs Entra ID P1 or P2. Microsoft 365 Business Premium, E3, E5 and F3 include Entra ID Premium
• Bypass users: anyone Duo would normally let through without MFA (bypass status, a policy that skips 2FA, or an authorised network that does not require 2FA) gets an error instead and cannot finish signing in, so review these before go-live. A valid remembered-device session still works
• Other Microsoft methods: to steer users to Duo, Duo advises completing the move to the Entra authentication methods policy, switching off system-preferred MFA, and turning off or excluding Duo users from the registration campaign
• Self-service password reset: users who rely on Entra SSPR cannot be limited to Duo alone; they need at least one Microsoft built-in method that SSPR supports, enabled alongside Duo
• Fail-safe access: roll out by group rather than to all users and apps at once, keep at least one Microsoft built-in method for admins, and exclude an emergency admin account from the policy

Guest users and cross-tenant sign-ins

Guests and users from partner tenants need extra configuration. Duo provides a separate Client ID (Guest/Cross-Tenant) value, and each user's Entra ID Object ID must be stored as a username alias in Duo. Without that, external guest sign-ins through Duo are not supported.

For cross-tenant access, the resource tenant must also trust MFA claims from the user's home tenant through Entra cross-tenant access settings. If it does not, the user needs to satisfy MFA in their home tenant first. We check these settings as part of any Microsoft 365 project with suppliers or group companies sharing a tenant.

Option 2: Duo SSO federation for Microsoft 365

With federation, Duo Single Sign-On becomes the SAML 2.0 identity provider for a custom Microsoft 365 domain, so users sign in on Duo's page and complete MFA in the Universal Prompt before reaching Microsoft 365. An optional WS-Trust setting supports older clients and Entra ID joined devices that cannot use the browser sign-in.

What to know before federating:

• Duo SSO needs Active Directory or Duo Directory as its authentication source for this application; SAML authentication sources cannot be used
• Users must already exist in Microsoft 365, so directory synchronisation needs to be in place
• You can only federate a custom domain, never the onmicrosoft.com domain, and it cannot be the tenant's default domain. Each federated domain needs its own Duo application. Keep a tenant administrator on onmicrosoft.com as a break-glass account
• Federation affects every user in the domain, so test on a separate domain with test users first. Switching over can take two hours or more
• With Entra Connect, Duo expects ms-DS-ConsistencyGuid as the source anchor; changing an existing anchor means reinstalling Entra Connect
• WS-Trust sign-ins skip Duo MFA, so Duo lets you restrict them by IP address, user agent and Duo group, and a connection must match all three
• Entra ID joined Windows devices use WS-Trust to refresh their Primary Refresh Token, so plan for that before leaving WS-Trust switched off
• Domains federated after 24 February 2022 pass an MFA claim to Entra ID automatically; domains federated before then need their federation settings updating, as described in Duo's knowledge base

Retiring the Conditional Access custom control

Many older Duo deployments used a Conditional Access custom control. A user could authenticate with Duo, but Microsoft did not count it as MFA. Microsoft Learn also lists features that custom controls cannot be used with, including policies that require an MFA claim, self-service password reset, sign-in frequency controls, Privileged Identity Management, Intune device enrolment and cross-tenant trusts.

Microsoft has deprecated custom controls. According to Microsoft Learn, new custom controls cannot be added and existing ones cannot be edited from September 2026, with full retirement planned for early 2027. Duo's documentation says its legacy Microsoft Azure Active Directory applications cannot be created or edited after 30 September 2026. If you still use a custom control, plan the move to External MFA now. Both can run side by side during migration, but users caught by both policies will be asked to authenticate twice.

Device trust with Microsoft Intune

Duo can treat a device as trusted when Microsoft Intune manages it. The Trusted Endpoints integration for Intune, included from Duo Essentials, uses a single-tenant app registration in Entra ID (set up by a Global Administrator) so Duo can check whether Windows, iOS and Android devices are Intune-managed. Windows devices also need Duo Desktop installed. Duo's device policies apply wherever Duo evaluates the sign-in, such as Microsoft 365 through Duo SSO federation.

If you use External MFA, Entra Conditional Access device compliance can do the same job on the Microsoft side. We design the combination that avoids double checks and gaps. See Cisco Duo device trust for the device checks in each edition, and our comparison of Duo and Microsoft Authenticator if you are weighing up the two.

We set up External MFA or federation, migrate custom controls, configure guest access, and test break-glass access before switching on enforcement. Contact us for a Microsoft 365 and Duo review.

How Forever Systems supplies and supports Cisco Duo

We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.

• Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
• Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
• Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
• Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
• Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes

Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.

Frequently asked questions

Explore Cisco Duo

Related from Forever Group

• Microsoft 365 security
• Microsoft 365 security assessment
• Microsoft 365 from Forever Group
• Microsoft Intune