Duo SSO with Cisco Umbrella and OWA

[rdbrooks]

Hi all,

I was wondering if i setup Duo SSO for OWA and Azure/M365 and Cisco AnyConnect/ISE/Umbrella, if for example a user authenticates against AnyConnect with Duo first, does that mean they won’t need to authenticate for any of the other Duo applications like OWA?

[raphka]

Hi rdbrooks,

There are a couple of ways to approach this.

1: If you use our Duo SSO protection for AnyConnect, then you would be able to make use of Remembered Devices policies to prevent repeated 2fa authentications, assuming they all happen within the same browser.

Duo Security

Duo Administration - Policy & Control

Duo’s Policy & Control feature enable centralized settings management.

2: Alternatively, assuming you are protecting the VPN itself with Duo, you can always leverage Authorized Networks policies to exclude the external VPN IP from 2fa requirement.
Please find the documentation for the Authorized Networks policy below:

Duo Security

Duo Administration - Policy & Control

Duo’s Policy & Control feature enable centralized settings management.

You should take care however to not exclude the VPN protection itself from 2fa by using targeted application policies for the specific applications you wish to bypass when a user has already authenticated via the VPN.

Duo policies can be applied to:

• A group of users for an application:
  Duo Administration - Policy & Control | Duo Security
• All users for an application:
  Duo Administration - Policy & Control | Duo Security
• or Globally for all users on all applications
  Duo Administration - Policy & Control | Duo Security

With regards to policy conflicts the most specific policy applies.
Group Policy > Application Policy > Global Policy.

Please find the Guide to Duo Policies below:
https://help.duo.com/s/article/policy-guide