Skip to content
Cisco Duo logo

Cisco Duo

IT & Security · duo.com

Is this your tool? Claim this listing →

Overview

Cisco Duo is a cloud-delivered identity security service that adds multi-factor authentication, single sign-on and device-trust checks in front of business applications, VPNs and remote desktops. It authenticates users through the Duo Mobile app, passkeys, security keys or phone-based methods, and can block access from endpoints that fail posture or management checks. Duo publishes a four-step Free/Essentials/Advantage/Premier edition ladder and integrates with hundreds of documented applications and network devices.

The problem Cisco Duo solves

Most breaches start with a valid but stolen credential, and the applications a company needs to protect are split across modern SaaS and older infrastructure like VPN concentrators, RDP and Windows logon that a cloud identity provider alone does not cover. Duo puts a single MFA and policy layer in front of both, and can additionally require that the device itself is known, managed or passing posture checks before access is granted. Its published integration catalogue spans network gear from Cisco, Palo Alto Networks, Fortinet, F5 and Ivanti alongside SaaS such as Microsoft 365, Google Workspace, Salesforce and Slack.

Decision context

Use these points to test whether the product fits your operation, not just whether it has a long feature list.

  • Published starting price: Free. Confirm user, usage, and feature limits for the plan you would actually buy.
  • Deployment: cloud. Check security, data-residency, and access requirements for every team that will use it.
  • Verified integrations include Microsoft Entra ID, Microsoft 365, Active Directory Federation Services, Microsoft Intune, Okta, PingFederate. Validate sync direction and plan limits for the connections that matter.
  • This record was last checked on 7/31/2026; pricing and features can change.

How to evaluate Cisco Duo

A listing helps create a shortlist; a trial with the team’s real workflow decides whether the tool fits. Use this reading with the structured facts and confirm changes with the vendor.

Workflow fit

The record describes it as a fit for IT teams that need to put MFA in front of a VPN, RDP or Windows logon quickly, Small businesses under ten users who want real MFA at no cost, Organizations enforcing device-trust and posture rules before granting app access. Check that this context matches the volume, roles, and processes your team needs it to support.

Pilot questions

  • Can Cisco Duo complete the critical workflow without manual work outside the product?
  • Do the recorded connections (Microsoft Entra ID, Microsoft 365, Active Directory Federation Services, Microsoft Intune) support the sync direction, permissions, and volume we need?
  • What user, usage, storage, support, or security limits appear after the headline starting price?

Evidence and freshness

This record was checked on 7/31/2026. That date tells you when the record was reviewed, not that the vendor has left its terms unchanged since then.

Best for

  • IT teams that need to put MFA in front of a VPN, RDP or Windows logon quickly
  • Small businesses under ten users who want real MFA at no cost
  • Organizations enforcing device-trust and posture rules before granting app access

Not a fit if

  • Teams wanting a full customer identity (CIAM) platform for external end users
  • Buyers who need built-in privileged credential vaulting and session recording

Why it’s listed

  • Publishes transparent per-seat list pricing across four editions plus a genuinely usable free tier for teams of ten or fewer, which is rare in enterprise identity security.
  • Documented integrations span both SaaS apps and network infrastructure (VPN concentrators, RDP, Windows logon), so it covers legacy access paths that pure cloud IdPs often do not.
  • Backed by Cisco with FedRAMP Moderate authorized federal editions, making it viable for regulated and public-sector buyers as well as SMBs.

Pricing

Duo Free

Free

Best for small businesses with 10 or fewer users.

  • Up to 10 users
  • Strong multi-factor authentication
  • Seamless application integrations
  • Free Duo Mobile authenticator app

Duo Essentials

$3 per user / month

Best for simple security management and seamless authentication.

  • Duo Directory
  • Phishing-resistant MFA
  • Complete passwordless authentication
  • Single sign-on
  • Trusted Endpoints
  • Unlimited applications

Duo Advantage

$6 per user / month

Best for dynamic threat detection, oversight, and authentication.

  • Everything in Duo Essentials
  • Cisco Identity Intelligence (cross-identity visibility, ISPM and ITDR)
  • Duo Passport
  • Session theft protection
  • Active Directory Defense
  • Risk-Based Authentication

Duo Premier

$9 per user / month

Best for comprehensive identity security with complete device trust.

  • Everything in Duo Advantage
  • Comprehensive Zero Trust access package
  • VPN-less remote access to private resources
  • Complete device trust with endpoint protection check

Features

Audit logsAuthentication, administrator action and telephony logs are retrievable in the Admin Panel and via the Admin API for SIEM export.
Compliance reportingBuilt-in reports (authentication, device insight, policy impact) plus log export support audit evidence, but there are no packaged framework-specific compliance reports.
Device managementDuo does device trust and posture checking via Duo Desktop and Trusted Endpoints and reads management state from Intune, Jamf Pro, Workspace ONE and others; it is not an MDM itself.
Multi-factor authenticationCore product: push, passcodes, phone call, hardware tokens, passkeys and phishing-resistant methods; available in every edition including Free.
Privileged access managementNo credential vaulting or session recording; Duo layers MFA and SSO onto third-party PAM tools such as CyberArk Privileged Access.
Public APIAdmin API and Auth API cover users, phones, tokens, admins, integrations and log retrieval; included with Essentials, Advantage and Premier.
Role-based access controlNine standard admin roles (Owner, Administrator, User Manager, Help Desk, Security Analyst, Application Manager, Billing, Read-only, Account Switcher) plus custom roles on paid editions; Free plan admins are all Owners.
SCIM / directory provisioningInbound SCIM 2.0 from Okta or any SCIM-compliant directory; Entra ID users are imported via Duo Directory Sync rather than SCIM.
Self-hosting / on-premCloud-only SaaS. The on-premises Duo Authentication Proxy is only a connector to on-prem directories and appliances, not a self-hosted deployment of the service.
SSO / SAMLDuo SSO supports SAML 2.0 and OIDC with hundreds of prebuilt app integrations; requires Essentials or above.

Integrations

Microsoft Entra IDMicrosoft 365Active Directory Federation ServicesMicrosoft IntuneOktaPingFederateOneLoginGoogle WorkspaceCisco ASACisco MerakiPalo Alto NetworksFortinet FortiGateF5 BIG-IPIvanti Connect SecureJamf ProVMware Workspace ONESalesforceServiceNowSlackDropboxAtlassian CloudCyberArk Privileged AccessSplunkGitHub Enterprise

Security & compliance

SOC 2ISO 27001PCI DSSNIST 800FedRAMP Moderate (Duo Federal editions)FIPS 140-2 (Duo Federal editions)

Pros & cons

Pros

  • Deployment and day-to-day administration are repeatedly described as fast and low-friction, with a straightforward admin portal.
  • Broad, well-documented integration coverage across VPNs, Windows/RDP, cloud IdPs and hundreds of SaaS applications.
  • The Duo Mobile push experience is easy enough that non-technical staff and executives need little training.
  • Multiple authentication method fallbacks (push, passcode, phone call, hardware token, passkeys) keep users unblocked.

Cons

  • Heavy dependence on the user's phone: a lost, dead or forgotten device turns into a help-desk event.
  • Push notifications are reported to occasionally lag or fail to arrive, delaying logins.
  • Cost draws complaints on larger deployments, and buyers note competitors price basic MFA lower.
  • Deeper reporting and analytics are gated behind the higher Advantage and Premier editions rather than the entry paid tier.

What we found

4.7/5
548 reviews aggregatedLast checked 2026-07-31

Capterra shows 4.7 out of 5 across 548 reviews, the largest public review base of the three major platforms, while G2 lists 4.5 out of 5 from 495 reviews and TrustRadius carries 401 reviews with a Top Rated designation. Reviewers across all three consistently praise fast rollout and an easy end-user push experience, and consistently raise mobile-device dependency, occasional push delays and cost at scale.

Ratings and review counts come from public review platforms. We link to the original source and keep the underlying review text out of this profile.

User reviews

Written by Audyense accounts · moderated before publishing

No user reviews yet.

Used Cisco Duo? Be the first to tell other buyers what actually worked.