Duo Single Sign-On (SSO) for Microsoft 365

[@melchiorgalea]

We are currently using Microsoft Authenticator at our tenant. So if I federate DUO, would all the unenrolled users not be able to sign in? I am currently still testing and would like to just enable it for myself and a few other users at the moment. How can I do that? Thanks

[@NetworkWizkid]

No, not necessarily. You could either create policies within Duo to only prompt MFA for yourself and the other users that will be testing. All other users would continue to authenticate without Duo MFA. You could also use the staged rollout feature that Microsoft has (Please see here for more info: networkwizkid.com/video-series-microsoft-365-staged-rollout-with-duo-single-sign-on-multi-factor-authentication/) I have also put a deployment options guide together here that might help you: networkwizkid.com/integrating-duo-with-microsoft-365-a-practical-guide/ I hope that helps and thank you for watching.

[@xenan33]

Does duo SSO require an on-prem AD for this setup? or can we leverage Azure AD?

[@NetworkWizkid]

On-prem AD is currently still required. You could take an hybrid approach where you sync AD with Azure AD to make use of both but unfortunately you cannot do it without on-prem AD at the moment. So, technically you can still leverage Azure AD but must have it configured via on-prem. I hope that helps.

[@federicolopez7983]

@@NetworkWizkid - Let's say that an organization is already set up to use AAD connect or AAD cloud sync from on-prem AD to Microsoft Azure AD. What application would we be protecting and what would be the approach to make sure all of the M365 apps are protected with 2FA?

[@NetworkWizkid]

In that scenario you would likely federate the custom domain with Duo SSO. That way you would be able to leverage Duo MFA and its other capabilities. If you already have applications that leverage the custom domain credentials then they would then also be redirected to Duo because once federate Duo would 'act' as the IdP. I recently wrote an article on integration methods for M365 with Duo here: networkwizkid.com/integrating-duo-with-microsoft-365-a-practical-guide/ Maybe this will help too.

[@peterjust7354]

With Duo SSO enabled, will the sign in logs show that MFA is applied? We have Duo enabled through a CA and a custom control. But the Entra logs always show single factor.

[@adrianforsyth6770]

I need a pitch correcting speedup function for this video. Unfortunately. at 3x speed im running into pitch issues that is stopping me from increasing it further :(

[@NetworkWizkid]

Sorry I'm not following! Assuming you're referring to the speed of the video - x2 Speed is the max that the video can be played back on, and I don't recommend that. If you're having trouble following the video then try subtitles or go and check out the Duo documentation.

[@usernamesarestoopid]

Does this require P1 license in M365?

[@NetworkWizkid]

No! P1 license only if you want to use Duo with conditional access.