To advance Smart Access goals, Duo Desktop will be made available as an opt-in solution for application owners. Applications that opt in will require its end users to login using Duo Desktop. Duo Desktop will then evaluate the end user’s device hygiene before allowing them access to the application. This change provides an additional tier of protection for higher risk applications.

What is Duo Desktop?

Duo Desktop is an application–available through our existing Duo contract–that can be downloaded to a Windows, Mac, or Linux device. Once Duo Desktop is installed, it performs health checks whenever a user accesses Duo-protected applications. These health checks ensure the device meets the organization’s security requirements. For example, is the device running a compliant operating system version?

Why would applications use Duo Desktop?

Application owners and IT Departments may opt into using Duo Desktop in order to:

• Uphold Policy UW-526 Endpoint Management and Security.
  • “All devices accessing campus resources must be intentionally managed to reduce risk and safeguard proper and efficient operation of and appropriate access to the intended resource. Applicable standards are outlined in the standards document. Standards for a particular device are to be determined based on the use of the device and the sensitivity/risk of data accessed from a device.”
• Perform device health checks before accessing applications that contain sensitive and restricted data.
  • Definitions for sensitive and restricted data are found on the data classification page.

When will Duo Desktop be available?

Application owners will be able to opt into Duo Desktop for their applications by May 2027.  See below for additional information about key milestones.

How does Duo Desktop impact end users?

• Duo Desktop will only impact end users who are logging into applications that have opted into using Duo Desktop.
• End users who are using devices owned and managed by UW–Madison likely will not notice a difference. This is because the device health is kept up-to-date by a UW–Madison department.
• End users who are using devices not managed by UW–Madison:
  • Will need to download Duo Desktop.
  • May need to update their devices to meet device health checks before accessing applications that require Duo Desktop.

Key Milestones

Completed

• Charter approved by Smart Access Sponsors.
• Duo Desktop installed on select DoIT-owned computers. 
• NetID Login configured to allow an application to apply different security tiers by population. 
• Documentation that starts to define the limitations of Duo Desktop for example, specific web browsers.

In Progress

• Decision document for Smart Access Sponsor to decide if Duo Desktop will be made available/encouraged for non-UW Madison owned devices.
• Documentation that defines what constitutes a trusted device.
• Selecting 2-3 internal DoIT applications to implement Duo Desktop.

Upcoming

• Documentation that demonstrates the user experience and workflows. 
• Test Duo Desktop deployment with Departmental Support to understand the interaction with endpoint management tools and overall impact on machines. 
• Collaborate with CSOC to ensure Duo Desktop reporting and monitoring is appropriately shared. 
• Duo Desktop implemented for 2-3 internal DoIT applications.

Project Completion

June 30, 2027

Questions?

We will continue to provide updates on this work. Check back here to find the most up-to-date insights and information. In the meantime, if you have questions or concerns, please reach out to Jessica Esse and Abrianna Barca.