Hello everyone! Here are the release notes for the most recent updates we’ve made to Duo.
We have recently added the public version number to the title of release notes posts. This number can be found in the Duo Admin Panel and describes the version assigned to core components of the Duo service. Learn more here.
You can subscribe to notifications for new release notes by following the process described here. If you have any questions about these changes, please comment below.
What’s in this release?
New features, enhancements, and other improvements
New and updated applications
Bug fixes
See all bug fixes
New features, enhancements, and other improvements
Change to MFA authentication workflow for Safari users with WebAuthn security keys
- Beginning with Safari version 14.1, Apple added a requirement that users interact with the page displayed in their browser before completing an authentication using a WebAuthn security key.
- Safari users authenticating or enrolling in Duo with a WebAuthn security key will now need to click a button in a popup window before they can complete their action in Duo.
Banner message and HTML styling added to automatically generated emails
- Added simple HTML styling and a banner message at the top of emails sent as part of the following administrative workflows:
- Forgot password
- Directory Sync notifications
- Authentication reported as fraud by end-user
- Instant Restore activation reported as fraud by end-user
- Administrator locked out
- Administrator Duo Push activation
- The banner message reads:
This is an automated message from Duo Security.
Change to operating systems policy behavior for macOS 11.x.x
- Chrome, Firefox, Safari, and Microsoft Edge Chromium recently froze the reported version for macOS 11.x.x devices at 10.15.7. As a result of this change, Duo will no longer block authentications from browsers that we know have frozen their reported macOS versions in order to avoid inadvertently blocking users on up-to-date devices.
- To enforce a policy of macOS 11.0.0 or newer as the most up-to-date OS, we recommend provisioning the Device Health application. On devices running the Device Health app, OS policy is enforced based on the OS version reported directly by the device rather than by the browser’s user agent string. Refer to this Duo Knowledge Base article for more information.
New and updated applications
Duo Network Gateway version 1.5.12 released
- Now reports errors using a password-protected SSL key in either the DNG admin console or scripted configuration instead of causing the admin container to become unresponsive.
- Permits setting the maximum body size of a POST request to a value beyond the previously-fixed maximum of 128 MB via the DNG admin console and scripted configuration.
Duo Mobile for iOS version 3.55.0 released
- Various behind-the-scenes improvements and minor bug fixes to enhance your authentication experience.
Duo Mobile for Android version 3.55.0 released
- Various behind-the-scenes improvements and minor bug fixes to enhance your authentication experience.
Bug fixes
- Updated wording of the warning message that appears when deleting a Duo integration to emphasize that some integrations such as Duo Authentication for Windows Logon and RDP require locally installed components that also need to be removed before deleting the integration in order to prevent users from being locked out.
- Improved the validation logic of email addresses entered in Admin Panel fields.