I'm evaluating Duo Security for Microsoft 365 and Entra ID, but our organization still uses a hybrid environment with on-premises Active Directory. Has anyone deployed Duo in this setup, and are there any important limitations or configuration details to be aware of?
5 Answers
Using Duo across endpoints, VPN access, Microsoft 365, and other applications can provide a more consistent experience than asking employees to use separate MFA apps. Duo Desktop can protect workstation logins, while the mobile app or hardware tokens can handle other authentication flows. If you enable workstation MFA, decide carefully whether it should fail open or fail closed during an outage, since fail-closed settings can prevent users from signing in without administrative recovery.
It works, but the implementation can be somewhat clunky. Depending on the configuration, self-service password reset and kiosk scenarios may be affected. Some environments also require manually assigning Duo as the identity provider for users and adding matching aliases in Duo, so plan for extra administration and testing.
Duo is a reasonable choice when you already use it for other platforms or need hardware tokens and broader integrations. If Microsoft 365 is your only major requirement and you are starting from scratch, Microsoft Authenticator may be simpler because it is native to Entra. The best choice depends on whether you want one MFA system for all of your services.
Yes, Duo can work in a hybrid environment. One common design uses the Duo Authentication Proxy on-premises to communicate with Active Directory, synchronize or match users to their Entra accounts, and provide authentication during sign-in. This can also support SSO for other cloud applications that authenticate against your on-premises directory.
The supported approach is generally to configure Duo as a third-party or external authentication provider for Microsoft Entra. Duo has updated documentation covering the setup, but be careful with Conditional Access policies and test the sign-in flow thoroughly before enabling it broadly.
It’s worth checking the current Duo and Microsoft documentation rather than relying on older guides, since the external authentication options and requirements have changed over time.