We are in the inital stages of our deployment and struggling with how to allow users to “opt-in” to Duo without interrupting their critical work (at least without coordination).
We are utilizing Directory Sync, and a group to control who is eligible for Duo at any point in time, so we have the “should be using Duo” and “not required to use Duo” part of the problem figured out. Fully enrolled users are (as we are seeking), prompted for Duo as expected, and denied access if they are unable to complete the authentication.
Where we are getting stuck is for users that have opted-in (or been opted-in because of their role), but have not yet enrolled. Our preference would be to nag them to enroll, but allow them to continue without MFA for at least some period of time.
The self-enrollment does not appear to offer any “skip for now” option, so we were pursuing a New User policy involving “Allow unenrolled users to pass through without two-factor authentication.”
However, if we pair that with Authentication policy of “Require two-factor authentication or enrollment when applicable…” synced by unenrolled users forced to enroll, and if we use the “Skip two-factor authentication or enrollment when applicable…” policy, no users are prompted by Duo.
So, is there a way to accomplish our goal:
- All fully enrolled users are prompted for Duo authentication.
- Partially enrolled users are allowed through without Duo auth, in some form.
Thanks in advance.
