I'm evaluating Duo Security for a Microsoft 365 and Entra setup that still uses on-premises Active Directory. Does Duo support this kind of hybrid environment, and are there any important configuration limitations or gotchas to be aware of?
5 Answers
Many organizations use Duo across endpoints, VPN access, Microsoft 365, and other applications so employees have one MFA experience. If you also use Duo Desktop for operating-system logins, decide whether the client should fail open or fail closed during an outage. Fail-closed settings provide stronger enforcement but can require administrative recovery if the MFA service is unavailable.
Microsoft Authenticator is another option, but Duo can make sense when it is already used for VPNs, workstation logins, non-Microsoft applications, or physical security tokens. The main benefit is giving users one consistent MFA method instead of splitting authentication between multiple apps.
It’s definitely possible, but some deployments can be a little clunky. Depending on the configuration, self-service password reset and kiosk scenarios may be affected, and user mapping or aliases might need to be managed manually. Plan for some testing rather than assuming it will be completely automatic.
Yes, Duo can work in a hybrid environment. One common setup uses an on-premises Duo Authentication Proxy to communicate with Active Directory, synchronize or match users with their Entra identities, and handle authentication for Microsoft 365 and other cloud applications.
The supported approach is generally to configure Duo as a third-party or external authentication method while keeping AD or Entra as the primary identity source. It works, but make sure you review how Conditional Access policies interact with the external MFA flow.
The vendor’s current setup documentation covers the external authentication process, so it’s worth following that version rather than relying on older implementation notes.