Details | Basic | Advanced | Premium |
Multifactor Authentication | Basic | Advanced | Premium |
MFA with Duo Push for iOS and Android | | | |
MFA with security keys, U2F, OTP, phone callback1, SMS & hardware tokens | | | |
Telephony credits | | | |
100 credits/user/year | | | |
User self-enrollment & self-management | | | |
Access user risk with phishing simulation | | | |
Endpoint visibility | Bsic | Advanced | Premium |
A dashboard of all devices accessing applications | | | |
Monitor and identify risky devices | | | |
Visibility into security health of laptops and desktops (Duo Device Health application) | | | |
Visibility into security health of mobile devices | | | |
Identify corporate owned versus BYOD laptops and desktops | | | |
Identify corporate owned versus BYOD mobile devices | | | |
Identify if a third-party agent is enabled on the device (Ex: Anti-virus, Anti-malware) | | | |
Adaptive Authentication & Policy Enforcement | Basic | Advanced | Premium |
Assign and enforce security policies globally or per application | | | |
Enforce policies based on authorized networks | | | |
Enforce policies based on user's location | | | |
Assign and enforce security policies per user group | | | |
Block Tor and anonymous networks | | | |
Enforce device trust policies based on security health of laptops and desktops (out-of-date software, encryption, firewall, etc) | | | |
Enforce device trust policies based on security health of mobile devices (encryption, tampered, screen lock, biometrics) | | | |
Notify users to remediate their devices | | | |
Limit device access to applications based on enrollment in endpoint management systems such as Landesk, JAMF, Microsoft Intune | | | |
Limit mobile access to applications based on enrollment in MDMs (AirWatch, MobileIron, Microsoft Intune) | | | |
Secure Application Access & Single Sign-On (SSO) | Basic | Advanced | Premium |
Unlimited application integrations | | | |
SSO for all cloud applications | | | |
Secure access to internal company web applications (Duo Network Gateway) | | | |
Secure access to specific internal servers via SSH (Duo Network Gateway) | | | |
Secure remote access to applications hosted in AWS, Azure, and GCP (Duo Network Gateway) | | | |