Licenses for WS Trust accounts?

[stevenspray1]

Hi

As per subject, do accounts not supporting modern authentication, iow bypassing DUO, need a DUO license?

[jamieis]

Hi @fnanfne,

WS-Trust authentication with Duo Single Sign-On for Microsoft 365 utilizes the same users as using modern authentication. If your policies allow unenrolled users they would be let through without enrolling and wouldn’t add to your user count though we recommend getting all users enrolled in Duo to be able to provide them with Duo MFA protection and policy enforcement.

[stevenspray1]

Thanks for the reply Jamie. It pains us to allow even just one “account” to bypass DUO in this way, as it’s now an annoying and unnecessary concern. However, some of our accounting- and support functions simply cannot support modern authentication, at least yet.

Unbelievable blindness on my part, I now see the option right under my nose…“Bypass Users”. However, the licenses are not being salvaged when I enable this on the accounts need to be re-added?

Also, what is the difference between adding these accounts to WS Trust vs flipping the “bypass” switch?

[jamieis]

Hi @fnanfne,

I think instead of Bypass Users you may want to look at New User Policy which will instead of bypassing all users from using Duo MFA will just allow unenrolled users which will still let WS-Trust work without enrolling the user in Duo.

[stevenspray1]

Great stuff thanks again Jamie!