Duo Authentication Methods - Best Practices & Rollout Strategies

Hi, I'm Mariah Willitzki. I'm a customer success specialist here at Cisco, and today I'm gonna give a quick overview of Duo's authentication method options, best practices, and rollout strategies. When it comes to multi factor authentication, one size simply does not fit all.00:00Duo offers multiple authentication methods and choosing the right combination can significantly approve both security and user experience. So let's start by looking at Duo's authentication options and how they support different security needs and use cases.00:20For phishing resistance and the highest level of protection, Duo supports web authentication pass keys and duo mobile proximity verification. Pass Keys include built in device biometrics such as Windows Hello or touch ID, as well as hardware security keys.00:38Duo mobile proximity verification uses Bluetooth to confirm that the access device and the authentication device are physically near each other. These methods are phishing resistant and provide strong protection against modern credential based attacks.00:58Next is verify Duo push. This requires users to enter a verification code shown on their screen, helping prevent push fatigue attacks and accidental approvals. Following that, our Duo Push and duo desktop authentication.01:15These methods offer strong security and an excellent user experience and they're also easy to deploy at scale. Because they integrate seamlessly with existing devices and require minimal setup for end users, they are often our fastest way for organizations to roll out MFA while maintaining high adoption.01:31Duo does also support passcode based options, including ubikey passcodes and duo mobile passcodes and hardware token passcodes. These methods remain secure, but they do offer less phishing resistance than passwordless or push based options and are commonly used as our backup methods.01:52Finally, for legacy or edge case scenarios, Duo supports SMS passcodes and phone call authentication. While these options do remain available, they should be treated as fallback or exception methods whenever it's possible.02:12Now, let's talk about best practices. A strong approach is to prioritize phishing resistant authentication methods for high risk users while using verified duo Push as a default for the broader user population.02:28Always enable at least one backup method to avoid any lockouts. When possible, avoid relying solely on SMS or phone call authentication. Instead treat these as temporary or fallback options while you guide users towards stronger methods.02:44Duo's policy engine makes this very easy by allowing you to apply authentication requirements based on user role, device trust, location or application risk. Finally, think about rollout strategy.03:01Start with a small pilot group, often IT or security teams to validate your policies and user experience. Then begin to expand it in phases using duo's self enrollment tools and clear communication to continue to drive adoption.03:17Over time, your goal should be to move users up the security ladder, not just deploy MFA, but continuously strengthen it. And with the right mix of authentication options and a thoughtful rollout strategy, Duo helps you secure access without slowing any users down.03:34Thanks for watching.03:53