Duo Policy Best Practices and Policy Calculator - Bite-Sized Video

Hi, I'm Mariah Willitzkey, customer success specialist here at Cisco. And today I'm gonna give a quick overview of Duo's policy hierarchy, best practices, and how to best leverage the policy calculator. Policies are the foundation of duo's adaptive access controls.00:00They're gonna define how users authenticate, what devices are allowed, and what conditions must be met before granting access. And a well designed policy framework is gonna balance strong security with minimal friction for end users all while protecting those sensitive applications without any unnecessary prompts or blocks.00:19Understanding policy hierarchy is key when managing duo. Global policies apply to every user and application in your environment. This is your broad baseline, so think of it as the default security posture.00:41Application policies override global policies for a specific application. Use these to tighten controls on high risk apps like VPN or like email. And group policies are the most granular. It's gonna apply to a specific subset of users that you choose.00:57And if there are multiple policies, the 1st policy listed has the highest precedence. Here are the top best practices when you're building duo policies. 1st start with defaults, then you could layer on specificity, apply global.01:16Rules 1st and then refine at the application or the group level.01:36Prioritize high risk applications and users. Critical apps like email or VPN should enforce stricter controls such as device health checks. Use location and network restrictions wisely, Allow trusted networks, block high risk geographies, and then plan.01:41For traveling users with bypass options.02:00Test before enforcing. Start with a report only or a small pilot group to validate the impact and review regularly. Policies are not set and forget. You need to reevaluate quarterly as your environment continues to change.02:05The duo policy calculator is like a what if tool that shows exactly how Duo would handle a specific login attempt. To navigate to the calculator, we're gonna select policies on the left hand side, select policy calculator, and from here you're gonna select a user.02:23And the app that they're trying to log into. Then Duo is gonna look at every policy that applies to that user, global, application, and group policies, and it's gonna figure out which role would win based on the policy hierarchy.02:41It's then gonna show you the final decision, allow, deny, or require extra verification, and then furthermore, it's gonna break down why it made that decision showing you where each rule came from. This is gonna be helpful with troubleshooting. You could see why a user is being blocked or asked for MFA unexpectedly.02:56The policy calculator is also gonna give you an option to test a new policy's behavior prior to full deployment.03:16This is also going to be useful for auditing. You could prove to compliance or security teams exactly how login decisions are being made. And that's how you could use Duo's policy and the policy calculator to keep your environment secure without slowing down your users.03:24Thanks for watching.03:41