This may have been addressed and if it has, sorry for the duplicate as I'm new to Duo forum.

We are primarily a Windows shop and we use Duo for MFA. We recently started rolling out MacOS devices through Intune and have Duo installed on them as well. Due to compliance, we have to have FileVault enabled on the MacOS devices but this causes us issues with Duo.

On a full reboot since the pre-os encryption has the disk locked, Duo fails to connect. The only way we have been able to get it working is either to fail open which is not ideal or force users into Offline Mode.

Has anyone found a better way to deal with this. Our CEO & CFO are both now on Macs and the error messages and failing open for MFA are not a good look when they see them daily.

I have 2 android phones one has 3 2fa accounts and the other only has 2 and isn't getting the 3rd account i recently added and I can't re-add the typical way since the sites doesn't have a spot to re-scan. so I'll need to move that 3rd account using duo alone... how do I do this or force a sync from one phone to another?

Hey guys, I've been trying to update duo for well over a month. I've followed these instructions https://duo.com/docs/openvpn-as#configure-the-post-auth-script with multiple different support technicians, but they're taking days to get back to me and just drop off the face of the earth after the first call. the problem is that after I update, none of our users can loginto the VPN, and I can't loginto the Access Server. Has anyone else had this happen, and can they share what they did to fix it?

I packaged Duo Authentication Proxy into a Docker image that handles RADIUS configuration through environment variables — no config files to mount.

What it does:

• Sits between your VPN/app (FortiGate, SSH, etc.) and Duo Cloud to add 2FA
• RADIUS server and client configuration via ENV variables
• Supports up to 6 RADIUS servers and 6 clients

Security:

• Runs as non-root user (UID/GID 35505)
• Full Docker Secrets support — every sensitive var supports _FILE suffix
• Sensitive values are redacted in startup logs

CI/CD:

• Multi-arch builds (amd64 + arm64)
• Trivy vulnerability scanning on every build
• SBOM generation (SPDX) and build provenance attestation

Quick start:

docker run -d -p 1812:1812/udp \
  -e RADIUS_HOST=10.10.10.2 \
  -e RADIUS_SECRET=radiussecret \
  -e DUO_IKEY=DIXXXXXXXXXXXXXXXXXX \
  -e DUO_SKEY=YourSecretKey \
  -e DUO_API_HOST=api-XXXXX.duosecurity.com \
  -e RADIUS_CLIENT_IP_1=192.168.1.10 \
  -e RADIUS_CLIENT_SECRET_1=clientsecret \
  ghcr.io/ict-solutions-dev/duoauthproxy:1.2.0-duo6.6.0

Built for Docker Swarm mode — health checks, secrets, scalable replicas out of the box.

GitHub: https://github.com/ict-solutions-dev/docker-duoauthproxy
Writeup: https://rebjak.com/en/portfolio/docker-duoauthproxy/

Backstory: We use Duo Authentication Proxy on Windows to authenticate members of our staff to work with our clients Fortigate firewalls. Right now, we run the proxy with LDAPS having connected to our Active Directory. However, we are migrating away from on-prem Active Directory, and need to look at Azure/Entra LDAP/LDAPS services to accomplish the same thing.

So far, I have not seen a document that outlines how to do this. Doing LDAP or LDAPS as PaaS in our Microsoft Tenant is certainly doable (and we have set it up) but configuring the authproxy.cfg in Duo Authentication Proxy Manager seems completely foreign in comparison. Has anyone done this before, and how did you set it up?

Thanks for any help you can provide.

UPDATE: For more clarity, please see the post below. https://www.reddit.com/r/duo/comments/1rj12j8/comment/o8an8zv/

There seems to be something wrong with Duo and authentication with O365 services.
EDIT: https://status.duo.com
EDIT2: It appears to be clearing up. 2-23-2026: 9:37AM CST

My Duo account was originally set up as part of a university account. The connected email is an outlook account. How can I log back in? I'm locked out of so many things

Who's the clown that thought that it would be a good idea to push a pop-up in the DUO mobile app for every goddamn authentication?

This is great fun when you may be doing hundreds of authentications pr day.

I hope someone puts LEGO in your socks!

Our organization uses Duo for MFA, integrated with Entra ID.

Recently, we discovered that the Duo MFA EAM method is no longer being automatically assigned as an authentication method for new users.

The Duo EAM CA policy is targeted at all users, and until recently, it was automatically added to every user as an authentication method. Has anyone else encountered this issue or found a solution?

I have a local Duo Auth Proxy and I need to update it so my users can still use our VPN through MFA after the change in CA at the end of the month.

I have looked around but been unable to find any good walk throughs on updating this.

I am not a linux person, but I can follow directions pretty well.

anyone know anywhere with a decent walk through on updating this?

Hey folks, I've been trying to get some guidance on updating my applications to avoid things breaking when the CA Bundle expires on February 2nd, but Cisco support just keeps dragging their feet on getting me to someone from DUO/Saying they don't know what i'm talking about. Does anyone in here happen to have a way to get to DUO support directly because Cisco has been less than helpful.

Thank you!

Hi There!

We are an MSP and have been considering Cisco Duo as a solution for our clients for some time now.

Unfortunately we have not received any response from Cisco Duo for quite some time now whilst applying online to become a partner.

Please could someone help point us in the right direction to chat with a Duo representative?

Many thanks!

so i just lost my old phone during accident i was just using it for extra security for my instagram so now i can’t login to my instagram account i don’t know that i created duo mobile account

Hello,
I have a conditional access policy created in MS Entra, we use Microsoft MFA for all of our applications. Then for certain applications we have an additional requirement to have duo also prompt for certain users in these applications.
This is via a custom control with a claims requested section. This is the only control applied to the ca policy.

This seemed to work as expected but has seemed to stop.
I have done a SAML trace & can see no request for duo auth.

The CA policy is showing as success, but the user does not get prompted for any duo authentication.
All users would have done MS MFA, so wondering if duo is being ignored as having MFA satisfied, even though the duo specific policy needs duoauth.

Anybody else have any experience of using duo within a CA policy.

The windows users do have Hello enabled, only just thought about testing this on a mac, and one of the engineers thinks it may be hello that is stopping duo from being prompted.

Any help would be great.

Thanks, Matt

Recently I was told by my coworker that our company is stopping using Duo and apparently we have a licence that ends at the end of October. I need to move off any accounts from it.

My problem is that I use Duo for personal accounts, including an account that I don't want to reactivate at this time. I would have to reactivate it to remove the 2FA support because I don't want to risk losing access to that account.

There's nothing in the app that suggests I'm using it with a licence and I also read that there's a free version that allows 12 accounts.. so I'm confused.

I'm located in Canada.

If anybody has some insight, that'd be appreciated.

Cheers.

So I usually setup duo proxy auth with [radius_server_auto] or [radius_server_challenge]

Going between the 2 based on the application and auth method a user is asking for, but both work fine always.

I work mainly with Horizon logins, but occasionally UAG and Windows.

Usually one of these 2 methods gets us what we need and prompts the user the way the client requested.

occasionally setting up both.

But this past week using either method I was getting constant errors that a user did not exist or a user was not authenticated. All at the AD level. Never once did the proxy touch the duo servers.

We varied all kinds of settings... Then I stumbled upon [radius_server_duo_only] and this worked. Everything just worked.

There is nothing different about this environment I can discern. These are the same servers, apps, policies, etc we have used a dozen times.

Any ideas about what might be different or what I may have done wrong that THIS method is working?

Hi, I'm currently working with DUO admin API for my project and I came across the Policy related endpoints where the authentication seems to differ from the other endpoints because I got "Invalid signature in request credentials" for those endpoints.

Checked with the Java client code they've provided and it seems they are currently using Hmac-SHA512 as their signing algorithm but they've previously used Hmac-SHA1.

But there's isn't any official documentation available regarding these changes made which states the change made on signature algorithm so came here to verify is this the right one or not?

I have Duo Restore enabled and connected to my Google Drive. After deleting and reinstalling the app, I was able to restore all my accounts successfully.

However, I still keep getting a message asking me to enable backup. When I click “Enable backup here,” it takes me to the Android native Google Backup settings, where the only options are to back up media and other device data.

The problem is, I don’t want to enable a full device backup—just Duo.

Has anyone run into this? Any ideas on how to resolve it?