@cedstrom A group policy applied to GroupB has no effect on GroupA members (who are not also members of GroupB).
Example where any user can use Push for an application unless they are in GroupB, in which case they must use YubiKeys:
- Application or Global policy authentication methods allow Duo Push
- Group policy applied to GroupB on the application only allows hardware tokens
Example where most users can use any authentication method, but GroupA can only use Duo Push and only members of GroupB can only use Yubikeys:
- Application or Global policy authentication methods allow all authentication methods
- Group policy applied to GroupA on the application only allows Duo Push
- Group policy applied to GroupB on the application only allows hardware tokens
@Gigawatt
Removing an authentication method via policy also prevents enrollment of that method during inline enrollment (as in, enrollment while authenticating to that particular application). Since group policies can only be applied to users who exist in Duo, an application or global policy that restricts Duo Push would also prevent new users (unknown to Duo) from enrolling a Push device during inline enrollment.
But, since users can’t self-enroll hardware tokens during Duo enrollment anyway, you would have had to create those users in Duo somehow to then assign them the hardware token. Since the users already exist, they would not see first-time enrollment (so no way to enroll a different method via that path).
If you allow self-service device management on that application and have applied a group policy that restricts GroupB members to hardware tokens, then those users aren’t able to enroll other methods not allowed by their effective policy in device management,
