How to set up Cisco Duo: a roll-out guide

In short: Cisco Duo setup follows a clear order: plan your applications and users, create the Admin Panel account, sync users from Active Directory, Entra ID or Google, protect a first test application, choose inline or email enrolment, set policies, pilot with a small group, tell users what to expect, then roll out in phases.

Before you start

A Duo roll-out is mostly planning and communication; the technical work for each application is usually small. Before you touch the Admin Panel, gather:

• A list of applications people log in to: Microsoft 365 or Google Workspace, VPN, Windows and macOS logon, RDP, SaaS apps and on-premises systems
• Where your users live: on-premises Active Directory, Microsoft Entra ID, Google, or nowhere yet (in which case Duo Directory can host them)
• Who needs what: staff, admins, contractors and shared accounts, and anyone without a smartphone who will need a hardware token or security key
• Your edition: features such as device health checks and risk-based authentication need Duo Advantage; compare editions on the pricing page
• A break-glass plan: how admins will get in if something goes wrong, for example a separate emergency account and the use of bypass codes

Step-by-step Duo roll-out

1. Plan applications and users. Rank applications by risk and ease. Remote access, email and admin accounts usually come first.
2. Set up the Admin Panel. Sign up (new accounts start on a 30-day Advantage trial), add a second administrator with the Owner role so you cannot be locked out, and assign admin roles and administrative units so help desk staff only see what they need.
3. Sync your users. Add Active Directory, Entra ID or Google as a directory sync source to import users and groups, or host users in Duo Directory. Active Directory sync runs through the Duo Authentication Proxy.
4. Protect a first test application. Add a non-production SAML or OIDC app, protect it, and test with a separate user account: your Duo admin login is not the same as a protected-app login.
5. Choose an enrolment method. Inline self-enrolment through the Universal Prompt for web-based apps, or emailed enrolment links for RADIUS-based VPNs, RDP and other apps that cannot show the prompt.
6. Set policies. Review the global policy first, then add application and group policies: allowed authentication methods, new-user behaviour, remembered devices and, on higher editions, device and risk rules.
7. Run a pilot. Enrol IT staff and a few willing users from different teams and locations, and run them for at least a full working cycle.
8. Communicate with users. Tell people what is changing, when, why, and what a genuine Duo prompt looks like.
9. Roll out in phases. Add groups and applications in waves, watching logs and help desk tickets after each one before moving on.

Choosing an enrolment method

The Universal Prompt is Duo's current login screen. Support for the traditional Duo Prompt ended for most applications on 30 March 2024, and features such as Verified Duo Push are only enforced in the Universal Prompt, so any older integration still using the traditional prompt should be updated. Users of RDP, some VPN clients and other integrations that cannot show enrolment screens must be enrolled before those integrations are switched on. Users then manage their own devices through the self-service portal and Duo Mobile.

Integrations to plan carefully

• Microsoft 365 and Entra ID: decide between the Entra ID External MFA app and Duo SSO federation, and plan for guest users
• Windows Logon and RDP: test offline access and keep a recovery route for local admin accounts
• VPNs and firewalls: prefer SAML through Duo SSO where your VPN supports it; otherwise use RADIUS through the Authentication Proxy
• macOS logon: deploy through your MDM and check behaviour after macOS upgrades
• Everything else: see the Cisco Duo integrations hub

Communicating with users

Most roll-out problems are people problems. A short, clear message before each wave saves a lot of help desk time:

• Explain why: MFA protects their account and the organisation, and it may be needed for Cyber Essentials or insurance
• Show them how to install Duo Mobile and enrol, with screenshots from your own Universal Prompt
• Tell them never to approve a prompt they did not start, and how to report one; Verified Duo Push helps here
• Explain what to do with a new phone, and how to get help

Staff awareness training such as cyber security awareness training reinforces the message.

We run Duo roll-outs for you

Forever Systems plans and runs Duo deployments end to end: discovery of your applications, directory sync, integrations, policy design, pilot, user communications, enrolment support and hand-over to your help desk. We can also manage the Admin Panel for you afterwards. If you are still choosing an edition, start with Duo Essentials or contact us and we will recommend the right fit.

How Forever Systems supplies and supports Cisco Duo

We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.

• Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
• Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
• Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
• Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
• Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes

Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.

Frequently asked questions

Explore Cisco Duo

Related from Forever Group

• Cyber security awareness training
• Cyber Essentials checklist
• Microsoft Intune
• Cyber security services