A designated Azure admin service account to use for authorizing the Duo application access.

Microsoft 365 E3, E5, and F8 plans include Azure AD Premium, as do Enterprise Mobility + Security E3 and E5 plans.

An active Azure AD Premium P1 or P2 subscription including Conditional Access, with the P1/P2 licenses assigned to each user that will log in using Duo MFA.

Please refer to How to: Block legacy authentication to Azure AD with Conditional Access to learn how to control access from these client applications. You can use Conditional Access to block authentication from legacy Office clients that cannot support modern authentication. Microsoft relies upon modern authentication workflows to invoke Conditional Access policies, which in turn apply Duo's MFA custom control.

Mobile and Desktop clients that support Microsoft's modern authentication (such as Office 20 applications).Ĭonditional Access cannot add third-party MFA for Office clients that do not support modern authentication, such as Office 2010.

Note that Azure Active Directory Conditional Access protects cloud applications only when the user access originates from the following client applications: Be sure to review Azure Government's additional variations in Azure Active Directory Premium features. Please review Microsoft's Azure Conditional Access documentation before configuring Duo authentication in your Azure Active Directory tenant.Īzure Government does not yet provide support for custom controls in Conditional Access. Verify your Microsoft subscription features before proceeding. Conditional Access with third-party MFA custom controls requires an Azure Active Directory Premium P1 or P2 subscription.

Azure active directory domain services