In short: Duo for RD Gateway is a plugin that adds Duo MFA to Remote Desktop Gateway and RemoteApp connections, using Duo Push or phone call. A separate plugin protects RD Web Access sign-ins with the Universal Prompt. Installing the gateway plugin disables CAPs and RAPs, so Duo recommends Windows Logon on session hosts as the alternative.
How Duo protects Remote Desktop Services
A typical Remote Desktop Services deployment has three places where Duo can sit:
| Where | Duo integration | What the user sees | Factors |
|---|---|---|---|
| RD Web Access portal | Duo for RD Web Access | Universal Prompt in the browser after the password | Universal Prompt methods such as passkeys, security keys, Duo Push and Verified Duo Push |
| RD Gateway | Duo for RD Gateway plugin | A push or phone call while the connection opens; no interactive prompt | Duo Push and phone call only |
| Session hosts | Duo for Windows Logon | Duo prompt at Windows logon on the host | Push, Verified Push, passcodes, tokens and more |
The RD Web plugin protects the browser sign-in only. If users then launch RemoteApps through RD Gateway, Duo should also be on the gateway, and with both in place users get a second Duo request when a RemoteApp starts.
Important caveats with the RD Gateway plugin
- CAPs and RAPs are disabled: installing the plugin switches off RD Connection Authorization Policies and Resource Authorization Policies, and RD Gateway ignores any existing settings. Rebuild those controls elsewhere before go-live
- Limited factors: only Duo Push and phone call. Verified Duo Push, SMS and Duo Mobile passcodes, hardware tokens, security keys, platform authenticators and bypass codes are not supported, and policies that restrict push or phone call will stop users signing in
- No inline enrolment: users must already exist in Duo with a push-capable phone, and their Duo username should match their Windows username. Enrol everyone before switching it on
- Bypass risk: direct RDP to the Connection Broker or session hosts skips the gateway and its MFA, so block direct RDP to those hosts
RD Web Access in more detail
The RD Web Access plugin supports inline self-enrolment and self-service device management. Duo suggests a new user policy of Allow Access while testing, then Require Enrollment when you go live. Points to know:
- Users should connect with the standard Remote Desktop client rather than the Remote Desktop web client, which has known issues with Duo
- The RD Web server needs an RFC-compliant hostname, not an IP address
- After installation, RemoteApps may no longer launch from the RemoteApp and Desktop Connections feed in Windows
- Users must sign in through the standard RD Web login page (/RDWeb/Pages/en-US/login.aspx) for Duo to apply
- It fails closed by default if Duo cannot be reached, unless you choose the offline bypass option
- With several RD Web servers, each needs the same session key
Requirements
- Windows Server 2016 or later for both plugins
- RD Gateway: .NET Framework 4.5 and ASP.NET 4.5 for IIS
- RD Web Access: .NET Framework 4.7.1 or later
- Outbound HTTPS from the servers to Duo using TLS 1.2 or later; Duo advises against IP-based firewall rules because its addresses can change
- Separate Microsoft RD Gateway and Microsoft RD Web applications created in the Duo Admin Panel; the installers ask for each application's keys (integration key and secret key for RD Gateway, Client ID and Client secret for RD Web) and your API hostname
- Users enrolled in Duo with Duo Push or a phone before the RD Gateway plugin is switched on, with Duo usernames matching their Windows usernames
Microsoft ends support for Windows Server 2016 in January 2027, and Duo's support for its Windows applications on Server 2016 ends then too. If your gateway or session hosts still run Server 2016, combine the Duo project with an upgrade.
Which approach should you choose?
Duo itself recommends Windows Logon on the session hosts if you do not specifically need MFA at the gateway, because it gives an interactive prompt, more factors (including passcodes for people without signal) and keeps CAPs and RAPs working. In practice we usually suggest:
- Windows Logon on session hosts as the main control, with RD Web Access protected through its plugin where users start in a browser
- The RD Gateway plugin where policy demands MFA before any connection reaches the internal network, accepting the factor and policy limits
- Duo Network Gateway in Duo Premier if you would rather publish RDP without exposing RD Gateway at all
- A VPN protected by Duo where users need wider network access; see Duo MFA for VPNs
How we help
We review your Remote Desktop Services design, decide where Duo should sit, enrol users before enforcement, replace CAP and RAP controls where needed, block direct RDP paths and test from outside the network. Contact us to secure remote desktop with Duo.
How Forever Systems supplies and supports Cisco Duo
We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.
- Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
- Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
- Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
- Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
- Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Duo quote, trial or roll-out plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Duo work with RD Gateway?
Yes. Duo's RD Gateway plugin adds MFA to Remote Desktop Gateway and RemoteApp connections. It supports Duo Push and phone call only, needs users to be enrolled beforehand and disables CAPs and RAPs on the gateway.
Why does the Duo RD Gateway plugin disable CAPs and RAPs?
Duo documents that once its RD Gateway plugin is installed, Connection and Resource Authorization Policies become inaccessible in RD Gateway Manager and any existing settings are ignored. If you rely on them, Duo suggests Duo for Windows Logon on the session hosts instead, which keeps them working.
Can users enrol in Duo through RD Gateway?
No. The RD Gateway plugin does not support inline self-enrolment, so users must already be in Duo with a push-capable phone. The RD Web Access plugin does support inline enrolment.
Is RD Web Access protected by the RD Gateway plugin?
No. RD Web Access has its own Duo plugin that adds the Universal Prompt to browser sign-ins. Protect both if users launch RemoteApps from RD Web through RD Gateway.
Do I still need to block direct RDP with Duo on RD Gateway?
Yes. Direct RDP connections to the Connection Broker or session hosts bypass the gateway and its MFA. Block them, or put Duo for Windows Logon on the session hosts as well.