Duo Desktop coming in 2027

To advance Smart Access goals, Duo Desktop will be made available as an opt-in solution for application owners. Applications that opt in will require its end users to login using Duo Desktop. Duo Desktop will then evaluate the end user’s device hygiene before allowing them access to the application. This change provides an additional tier of protection for higher risk applications.

What is Duo Desktop?

Duo Desktop is an application–available through our existing Duo contract–that can be downloaded to a Windows, Mac, or Linux device. Once Duo Desktop is installed, it performs health checks whenever a user accesses Duo-protected applications. These health checks ensure the device meets the organization’s security requirements. For example, is the device running a compliant operating system version?

Why would applications use Duo Desktop?

Application owners and IT Departments may opt into using Duo Desktop in order to:

Uphold Policy UW-526 Endpoint Management and Security.
- “All devices accessing campus resources must be intentionally managed to reduce risk and safeguard proper and efficient operation of and appropriate access to the intended resource. Applicable standards are outlined in the standards document. Standards for a particular device are to be determined based on the use of the device and the sensitivity/risk of data accessed from a device.”
Perform device health checks before accessing applications that contain sensitive and restricted data.
- Definitions for sensitive and restricted data are found on the data classification page.

When will Duo Desktop be available?

Application owners will be able to opt into Duo Desktop for their applications by May 2027. See below for additional information about key milestones.

How does Duo Desktop impact end users?

Duo Desktop will only impact end users who are logging into applications that have opted into using Duo Desktop.
End users who are using devices owned and managed by UW–Madison likely will not notice a difference. This is because the device health is kept up-to-date by a UW–Madison department.
End users who are using devices not managed by UW–Madison:
- Will need to download Duo Desktop.
- May need to update their devices to meet device health checks before accessing applications that require Duo Desktop.

Key Milestones

Completed

All phase 0 (Duo Desktop Exploration) deliverables. This includes:
- Installing Duo Desktop on 4 DoIT-owned computers.
- Configuring NetID to allow applications to apply different security tiers by populations.
- Initial documentation that defines the limitations of Duo Desktop.
- A decision document for Smart Access sponsors on encouraging Duo Desktop for non-UW–Madison owned devices.
Phase 1: DoIT Pilot – Enable Duo Desktop as Proof of Concept deliverables
- Documentation that defines what constitutes a trusted device for the pilot.
- Documentation that demonstrates the user experience and workflows.
- IAM added an Duo Desktop check to the ⁠Login Diagnostic application, to allow end users to test if their device meets the healthy device requirements that will be enforced for applications that opt into using Duo Desktop.

In Progress

Phase 1: DoIT Pilot – Enable Tier 3: MFA Advanced Proof of Concept deliverables
- Finalize what constitutes a trusted device for the pilot with Smart Access Sponsors
- Duo Desktop implemented for 2-3 internal DoIT applications.
  - Cloud Account Database for 5 public cloud administrators in the development environment
  - AWS web console for 5 public cloud administrators in the ITE environment
  - NetID Login Metadata Manager for 5 IAM engineers in all environments

Upcoming

Phase 1: DoIT Pilot – Enable Tier 3: MFA Advanced Proof of Concept deliverables
- Decision document for project sponsor and Smart Access sponsors to determine phase 2 implementation parameters.
- Documentation that outlines feedback and implementation improvements from phase 1.
- Update Smart Access Sponsors with milestone project status report that can be used to support the budget cycle. This should include information on the infrastructure, applications tested, and future scaling needs.

Project Completion

June 30, 2027

Questions?

We will continue to provide updates on this work. Check back here to find the most up-to-date insights and information. In the meantime, if you have questions or concerns, please reach out to Jessica Esse and Abrianna Barca.