Duo Passport: fewer logins, safer sessions

In short: Duo Passport is a Cisco Duo feature that shares one remembered-device session across browsers, desktop applications, Windows Logon and RDP on the same computer, so users authenticate less often. It uses Duo Desktop and a key held in TPM 2.0 or Secure Enclave instead of a remember-me cookie. It is included in Duo Advantage and Premier, on Windows and macOS.

What is Duo Passport?

Remembered devices are a normal part of MFA: once a user has approved a login, Duo can trust that device for a set time. The problem is that each browser and each desktop application usually remembers separately, so a user can approve the same laptop five times in a morning. That repetition is irritating, and it trains people to approve prompts without thinking.

Duo Passport fixes this by sharing one trusted session across everything on the computer: your web browsers, desktop applications from trusted vendors, Duo Authentication for Windows Logon and RDP sessions. Sign in to Windows with Duo in the morning, and your SSO applications and desktop apps can reuse that session instead of prompting again.

Passport is included in Duo Advantage and Duo Premier.

How it works: sessions bound to hardware

Passport is not just a convenience feature. Ordinary remembered devices rely on a browser cookie, and cookies can be stolen by malware or adversary-in-the-middle phishing kits and replayed on an attacker's machine.

Passport does away with the remember-me cookie. When a device first registers, Duo Desktop generates a cryptographic key pair, keeps the private key on the computer using hardware-backed keys (which is why Windows devices need TPM 2.0 and Macs need a Secure Enclave), and sends the public key to Duo. Duo Desktop then signs the session data it sends, and Duo checks the signature against the registered public key. A session cookie copied to another computer is therefore not enough to reuse the session.

Duo lists session theft protection as a separate Advantage feature, and its Passport documentation describes how Passport reduces the risk of session hijacking by minimising the use of cookies.

Requirements

If you have older laptops without TPM 2.0, those devices will simply keep the normal prompt behaviour. We check this during planning so nobody is surprised.

Where Passport does not help

Duo is clear about the limits, and it is better to know them before rolling out:

• The first RDP login to a Windows server still prompts for MFA; Passport shares the session from then on
• Duo Desktop authentication (approving on the same computer) cannot start a Passport session
• Sessions from Duo for macOS Logon are not shared with web applications, although Macs can still use Passport for browsers and apps
• If an application demands a factor the original session did not use, such as a platform authenticator, the user authenticates again
• Choosing to remember devices per application stops sessions being shared, and applications must use the same remembered-devices setting (mixing risk-based and standard remembered devices blocks sharing)
• Sessions end when the user logs out of Windows, restarts, quits Duo Desktop or ends the RDP connection

Passport is about desktop and laptop sign-ins. It does not change how VPN MFA or other non-browser integrations prompt.

Turning Passport on

1. Make sure Duo Desktop is deployed to the computers in scope and devices meet the TPM 2.0 or Secure Enclave requirement.
2. In the Duo Admin Panel, create a policy that enables remembered devices for browser-based applications and sets the session length.
3. Apply that policy to the applications you want covered, including the Microsoft RDP application used by Windows Logon.
4. Under Policies, open Passport and enable it for a pilot group first, then for all users.
5. Test: sign in to a browser application and remember the device, then open a desktop app and check no second prompt appears.

Users can turn off session sharing in Duo Desktop preferences, and administrators can switch it off per computer, which is useful for shared kiosk PCs. See the Duo Admin Panel for how policies are layered.

Who Passport suits, and how we help

Passport is worth switching on if your staff work on Windows or Mac laptops all day across many Duo-protected applications, and you hear complaints about prompt fatigue. Fewer prompts make the prompts that do appear more meaningful, which pairs well with Verified Duo Push and risk-based authentication.

We check your devices for TPM 2.0 and Secure Enclave support, deploy Duo Desktop, tune remembered-device policies and pilot Passport before a wider roll-out. Already on Duo Essentials? Ask us for a quote to move to Advantage. Contact us to get started.

How Forever Systems supplies and supports Cisco Duo

We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.

• Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
• Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
• Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
• Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
• Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes

Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.

Frequently asked questions

Explore Cisco Duo

Related from Forever Group

• Phishing awareness training
• Cyber security services