How to use Duo MFA as main aunthentication method

[rsacramento]

Hello.

Is it possible to use Duo MFA as main authentication method ? Where the user does not need to type logon password, only use the Duo mobile app.

Thanks
All

[Amy2]

Hi @rsacramento, no it’s currently not possible to Duo for primary authentication. However, you might be interested in our Duo Passwordless solution which is now available in a public preview. At the end of that blog post are a number of videos which explain more. I hope that helps!

[rsacramento]

Thanks for your help.

I gonna take a look on this new solution.

[BusterDoney]

Actually it is possible to use Duo MFA as the primary authentication method. Some conditions apply:

• You need to use ADFS 2019 as your Identity provider.
• The application in question needs to be integrated with ADFS for SAML or OpenID.
• You can require Duo as your primary auth but users are still required to enter their password as their secondary auth; however, there are many options available for Keep Me Signed In, Certificate-based auth in lieu of passwords, tokens, Windows Hello for Business, etc.

Take a look at Protect the Password feature for ADFS to learn more about using MFA as your primary auth method. This isn’t a feature of Duo but rather a feature of the IdP.

[patrick-hk-fung]

Hi all,

I have encountered an issue while using DUO as Primary Authentication Method for ADFS.

Meanwhile, I've found this post.

When I use DUO as Primary Authentication in ADFS (i.e. accessing SAML2 integrated Shibboleth SP App with SP-initialized). The below error happen when an invalid user (i.e. User not exist in AD) information is used.

See if anyone encounter this problem also?

Thanks,
Patrick

[DuoKristina]

Of course AD FS looking up a non-existent user fails when the user doesn't exist in the directory?

[patrick-hk-fung]

Hi Kristina,

Many thanks for your reply. I found it the error is better if using OpenID Correct integrated application

They will not throw the error to the application side and the error message is more meaningful.