Overview
Cisco Duo is a cloud-delivered multi-factor authentication and access management service that grew from the original Duo Security business acquired by Cisco in 2018. Duo's reputation rests on the simplicity of its push-notification MFA, an extensive set of pre-built application integrations, and a Trusted Endpoints capability that distinguishes corporate-managed from unmanaged devices at authentication time.
Duo is widely deployed as the MFA layer in front of corporate VPNs, Citrix and VMware virtual desktops, on-premises web applications, and SaaS services. The product has expanded into single sign-on, passwordless authentication, and Verified Push to combat MFA fatigue attacks, while remaining priced primarily as an MFA-first platform. Duo is bundled into Cisco's broader User Protection Suite, which also includes Cisco Secure Access for SSE and zero-trust network access.
Key Features
- Push-notification MFA via the Duo Mobile app
- FIDO2 passkeys, WebAuthn, and security key support
- Adaptive policies based on user, device, network, and risk
- Trusted Endpoints to distinguish managed from unmanaged devices
- Single sign-on with SAML and OIDC for SaaS apps
- Verified Push to mitigate MFA-fatigue attacks
- Self-service device enrolment portal
- Passwordless authentication with biometrics or hardware keys
- Risk-based authentication with global threat intelligence
- Out-of-the-box integrations for VPN, RDP, and web SSO
- Device Health for posture checks at authentication
- Integration with Cisco Secure Access (SSE) and Umbrella
Pricing
| Edition | Model | Typical Cost |
|---|---|---|
| Duo Free | Up to 10 users | $0 |
| Duo Essentials | Per user / month | $3 |
| Duo Advantage | Per user / month | $6 |
| Duo Premier | Per user / month | $9 |
Pricing verified from duo.com May 2026. Annual billing. Duo licences are purchased in increments of 10 for under 100 users and 25 for over 100 users. Volume discounts of 10–25% are common for 500+ users.
Strengths
- Industry-leading user experience for push-notification MFA
- Free tier for up to 10 users makes evaluation friction-free
- Trusted Endpoints capability is one of the strongest in the category
- Broad integration coverage with VPNs, on-premises apps, and SaaS
- Strong roadmap for phishing-resistant authentication and passkeys
Limitations
- Workforce SSO catalogue is smaller than Okta or Entra ID for SaaS-heavy estates
- Identity governance and lifecycle management are absent; Duo is not a directory
- Customer identity (CIAM) is not supported
- Cisco bundling pressure can complicate pricing for non-Cisco customers
- Limited orchestration; teams needing workflow automation typically pair Duo with Okta Workflows or Entra ID Logic Apps