Duo Ordering Guide

 

1. Introduction

1.1 Purpose, Audience, and Scope

This document describes the pricing and packaging structure and ordering for Cisco^® Duo as an a la carte item.

Audience: This guide is for the Cisco field and any customer, distributor, or partner that can utilize CCW. Cisco Commerce Workspace (CCW) provides an integrated commerce experience that allows you to register deals, configure and price products, software and related services, and order from a single platform.

Scope: This ordering guide describes the pricing and ordering for the following products and services:

●     Cisco Duo Essentials (Formerly known as MFA)

●     Cisco Duo Advantage (Formerly known as Access)

●     Cisco Duo Premier (Formerly known as Beyond)

●     Cisco Duo Federal Essentials (Formerly known as MFA)

●     Cisco Duo Federal Advantage (Formerly known as Access)

●     Cisco Duo Telephony

●     Cisco Duo Token

●     Cisco Duo Services

For more detailed information on Cisco Duo products, go to https://duo.com/product.

Note:      Duo renamed the editions to better align with the Cisco Security Portfolio. There may continue to be reference to “MFA, Access or Beyond” on some materials during the transition.

1.2 Ordering and quoting tools

Cisco Commerce provides a Deals and Quotes application that enables the ability to build a system quote with:

●     Products, required modules, and software.

●     Auto-derived services based on products.

●     Design documentation.

For additional information about the Cisco Commerce Workspace, go to: https://apps.cisco.com/Commerce/home.

Cisco Commerce includes several helpful tools to estimate, configure, and order solutions, enabling you to configure products and view lead times and prices for each selection. It also allows you to view lead time and price changes under a variety of price lists and service contract terms. You can also track your order.

The following Cisco products, services and applications are supported in Cisco Estimates and Configurations Tool:

●     Cisco Duo Essentials

●     Cisco Duo Advantage

●     Cisco Duo Premier

●     Cisco Duo Federal Essentials

●     Cisco Duo Federal Advantage

●     Cisco Duo Telephony

●     Cisco Duo Token

●     Cisco Duo Services

1.3 Orderability and First Customer Order (FCO)

Orderability for the following products/applications will be enabled May 1^st, 2023:

●     Cisco Duo Essentials

●     Cisco Duo Advantage

●     Cisco Duo Premier

●     Cisco Duo Federal MFA

●     Cisco Duo Federal Access

●     Cisco Duo Telephony

●     Cisco Duo Token

●     Cisco Duo Services

Orderability for the following products/applications will be enabled Oct 30th, 2024:

●     Cisco Duo Federal Essentials

●     Cisco Duo Federal Advantage

The first Customer Order date for all the products/applications listed above was December 2, 2019; this updated guide is due to the renaming of the Duo editions.

2. Cisco software subscription

2.1 Product description

Cisco Duo provides the only security-first Identity and Access Management (IAM) solution built from the ground up to protect organizations from identity-based threats. Unlike traditional IAM solutions, Duo integrates all necessary components to serve as the sole IAM platform, while operating as a unified defense layer across your existing identity infrastructure.

Leveraging Identity Intelligence, Duo delivers deep, cross-platform identity visibility. It employs AI to analyze identity context from multiple sources across your ecosystem, ensuring continuous monitoring and proactive responses to identity threats before, during, and after login. To defend the entire authentication chain from advanced threats, Duo provides robust end-to-end phishing resistance that’s easily deployable without the need for additional hardware or complex implementations. 

By integrating security from the outset, Duo significantly lowers your total cost of ownership for identity management. It provides a world-class access experience for end users while simplifying implementation and management for administrators.

2.2 Editions

Cisco Duo Essentials

From setting up MFA for just a few users to securing your entire workforce, Duo empowers organizations to significantly reduce their attack surface, protect against identity threats, and demonstrate compliance while delivering a seamless user experience.

Get everything needed to secure your identity perimeter and boost user productivity. Duo Essentials is a strong security-first IAM solution that includes:

●     Duo Directory: simplify your identity stack using Duo as your source of truth for identity and security, removing the need for an external authentication source.

●     Phishing-resistant Authentication: prevent push phishing attacks by leveraging Bluetooth Low Energy technology to ensure the authentication and access devices are in close proximity.

●     Multi-Factor Authentication (MFA): protects against stolen credentials and account takeover with authentication factors such as Duo Push, Verified Duo Push, FIDO2 security keys and platform biometrics, and more.

●     Single Sign On (SSO): provides a consistent user experience and easy application access with a single login.

●     Complete Passwordless: enable an end-to-end passwordless experience from initial enrollment to authentication without falling back to passwords or reliance on third-party identity providers.

●     Trusted Endpoints: block access from unknown, unregistered devices and only allow trusted devices to gain access to resources.

●     Cisco AI Assistant for Duo: Fast-track user-related investigation and streamline Duo's setup and administration with reliable and accurate answers you can trust.

●     Visibility: view dashboard of all connected devices accessing applications with Device Insight.

Cisco Duo Advantage

Upgrade to Continuous Identity Security with Duo Advantage. Get cross-platform identity visibility and threat response capabilities, and a seamless access experience that is dynamically informed by risk – before, during, and after login. Duo Advantage provides complete visibility of identity security posture (ISPM), device health posture checks, AI-based identity threat detection and response (ITDR), dynamic risk-based authentication, and a seamless login experience that minimizes repeated authentications.

Includes Everything in Duo Essentials, Plus:

●     Cisco Identity Intelligence: identifies, detects, and responds to identity-based threats by gaining comprehensive visibility and AI-driven analytics across identity sources and incorporate identity context into Duo's risk-based authentication policies.

◦    With Duo Advantage and Duo Premier, each user license allocates up to five (5) identities in Cisco Identity Intelligence (CII). An identity is one “user” listed within the CII interface. If You exceed this allocation, Cisco will work with You in good faith to try to resolve that excess usage. You may be required to purchase additional Duo user licenses to obtain additional CII identities.

●     Duo Passport: authenticate once on a trusted device and get uninterrupted access to permitted applications across browsers and thick clients, minimizing repeated authentication requests and protecting against session theft.

●     Device Health: perform checks for updated operating systems, browsers, plug-ins and compliance with security policies.

●     Risk-Based Authentication: dynamically adjusts the authentication requirements in real-time based on risk signals.

●     Adaptive Access policies: enforce adaptive access policies per application based on user’s location, device health or network.

●     Duo Trust Monitor: machine learning that detects potential attacks in progress, and surfaces suspicious events.

●     Visibility and Reporting: full-featured dashboards and custom reports for compliance audits and ease of administrative management, with deeper visibility into devices.

Cisco Duo Premier

Duo Premier is our most comprehensive security-first IAM solution. Get complete zero trust access for every application and enable VPN-less remote access to private resources.

Includes Everything in Duo Advantage, Plus:

●     Duo Network Gateway: provides end-users with VPN-less remote access to private applications hosted on-premises or in multi-cloud environments while enforcing zero trust security principles. Enable secure, seamless SSO access to internal web applications (HTTPS) and servers via SSH, RDP and SMB.

●     Endpoint Protection Check limits device access to applications based on presence of an endpoint protection product (CrowdStrike, SentinelOne, Cisco Secure Endpoint, etc.).

Duo Telephony Credits

Duo supports telephony-based authentication such as SMS and phone callback. In order to use these authentication methods, a customer must have the adequate telephony credits in their account. Duo provides 100 telephony credits per user per year at no additional cost. Customers can purchase additional increments of 1000 credits for $15 USD, either on CCW or the Admin Panel within the Duo product with a credit card. Country availability includes:

Duo sub accounts

Some customers have the need for multiple, but related, Duo Security accounts. This can be accomplished through sub-accounts, creating child accounts under one parent account. A portion of the total licenses purchased are then allocated to that subaccount. Large customers, such as Universities or enterprise customers, may use sub-accounts to create multiple Duo instances for subsets of users within their organization. Sub-accounts must be the same edition as the parent account.

Sub-accounts are best used when a separate instance of Duo is needed. Enrolled users cannot use both instances, only one. Payments are made at the Parent Account level so if differentiated billing is required, this is not a good option.

The primary purpose for creating a sub-account is when customers need:

1.     Different subsets of users or departments within one customer.

2.     Separate instances for production versus test accounts.

Talk to the Account Manager to determine if a sub-account is advisable.

To include a Sub Account at time of order, select Sub Account from the Add-on menu. The number requested in the quantity field should reflect the number of licenses that are to be allocated to the Sub Account. This will be a portion of the total, not in addition to the total.

If a Sub Account needs to be added after the order is placed, use the Change/Modify process to add the Sub Account billing PID. This is a $0 PID.

Subaccounts are not available in the Duo Federal offer.

If more than one Sub Account is needed, contact Customer Support for assistance.

Duo hardware token

Duo also supports traditional one-time passcode-based hardware tokens for user authentication. While a Duo subscription does not come with hardware tokens, customers may purchase them in increments of 10 tokens for $300. All tokens ordered on a single order will need to be associated with a single subscription.

Tokens are not available for use with a FedRamp authorized, Duo Federal offer.

Splitting tokens across multiple subscriptions or migrating from one subscription to another is not possible.

For any questions regarding sample hardware tokens, Cisco Sellers can reach out to your Duo Account Executive. Cisco partners and Cisco Cybersecurity Partner Specialists can reach out to partners@duo.com or a Duo partner manager.

2.3 Customer experience

Cisco Technical Services for Duo

Cisco Software Support Services(SWSS) Basic Support is included with the purchase of every Duo subscription. No additional products or fees are required to receive these services with a software subscription.

Basic Support includes:

●     Access to support and troubleshooting for severity 1 or severity 2 cases (Critical/High) 24x7 via phone, online tools and web case submission. For Medium/Low priority cases support and troubleshooting will be 9x5 (i.e. 9 hours per day local time, for 5 days per week) via phone, online tools and web case submission.

●     Access to https://duo.com/support. The support site provides customers with helpful technical and general information on Duo products, as well as access to Duo’s online community and documentation.

Solution Support is a higher tier of reactive-only technical support for Cisco and Cisco Duo customers. It is a paid service.

Solution Support includes:

●     Access to support and troubleshooting via phone, online tools, and web case submission. Click here for Solution Support program information.

●     Cisco Duo support access 24 hours per day (local time), 7 days per week to assist by telephone (with decreased wait times), web case submission and online tools with application use and troubleshooting issues.

●     Access to https://duo.com/support. The support site gives customers helpful technical and general information on Duo products and access to Duo’s online community and documentation.

●     Solution Support is not available for the Federal Edition.

Software Support: Enhanced

Software Support Services (SWSS) Enhanced helps customers succeed during one of the most critical times in their subscription: during onboarding and implementation. To support customers with high-quality proactive support at a lower cost than Premium/Duo Care, Cisco provides SWSS Enhanced support using teams of Customer Success Managers and Engineers, and digital assets, all of which deliver onboarding and technical guidance, planning leadership, and adoption support.

SWSS Enhanced customers are also entitled to 24x7x365 phone and online troubleshooting support via the Duo Solution Support teams, and everything noted within Solution Support.

SWSS Enhanced support helps customers accelerate their return on investment by increasing active usage and guiding effective product security policy configuration in the customer environment.

SWSS Enhanced Support provides:

●     Strategic digital adoption and onboarding guidance from Customer Service Managers

●     24x7x365 Call-in and online case technical support from the Duo Solution Support team

●     Periodic product health checks

●     Higher priority ticket response with faster SLO

●     Accountability for issue management and resolution.

Refer to the https://duo.com/support. for more detailed information regarding SWSS Enhanced Support.

Support pricing is based on a percentage of product list price.

Enhanced Support is not available for the Federal Edition.

Software Support: Premium

Software Support (SWSS) Premium, also branded as Duo Care, is an essential element of Cisco Duo as it helps customers maximize their return on investment. With SWSS Premium Support, a team of Duo experts guides customers through the life of their subscription to ensure they maximize the value of their Duo investment as the organization and business needs evolve. Cisco Duo Care Premium Support also provides extended support services to ensure customers get the support they need when they need it most.

SWSS Premium customers are also entitled to 24x7x365 phone and online troubleshooting support via the Duo Solution Support teams, and everything noted within Solution Support.

SWSS Premium Support provides:

●     Strategic support from an assigned Customer Success Manager.

●     Technical support and response from an assigned Customer Solutions Engineer.

●     24x7x365 Call-in and online case technical support from the Duo Solution Support team, with limited Emergency support on Cisco observed holidays.

●     Extended Duo support access by a VIP support line, thereby providing a faster initial response time than SWSS Enhanced.

●     Accountability for issue management and resolution.

Refer to the data sheet for more detailed information regarding Cisco Duo Care Premium Support. Duo Care pricing varies based on the total number of user licenses purchased.

Technical Support for Duo

Customers and partners set up as the Duo Admin will access technical support using Duo tools and processes. The Duo Admin can initiate or check on the status of a support case online, by email or by contacting Duo by phone:

●     Duo Support Team

●     Online Support Portal

●     Phone:1 866 760-4247 (International Phone Numbers)

●     Email: mailto:support@duosecurity.com

Cisco Talos Incident Response

The Cisco Talos Incident Response (CTIR) retainer provides a full suite of proactive and emergency services to help customers prepare, respond, and recover from a cybersecurity breach. CTIR enables 24-hour emergency response capabilities and direct access to Cisco Talos^®, the world's largest threat intelligence and research group.

CTIR will be added to the Duo configuration by default, recommending the number of hours of CTIR service based on the license quantity. The auto-attached CTIR SKU can be removed and is not mandatory. Also, CTIR can be manually selected from the Services tab.

CTIR options available in the Duo configuration are as follows:

To learn more about CTIR, click here.

2.4 Licensing model subscriptions

Understanding the licensing model subscriptions overview

Cisco Duo is licensed on a subscription basis. Each end customer has only one subscription, though each subscription may comprise multiple products. Subscriptions are available for standard term lengths of 12-60 months. At time of ordering, the subscription is set to auto-renew as default; however, auto-renew can be turned off without triggering the deal to become nonstandard. If the order is booked as auto-renew, the subscription will be renewed automatically for an additional 12-month term following the completion of the initial term. If the removal of auto-renew after purchase is necessary, the auto-renewal option must be cancelled 60 days or more before the start date of the new term. Mid-term cancellations of subscriptions for credit are not allowed.

Cisco Duo Licensing

●     The user-based license follows a tiered-pricing model: pricing depends on the number of user licenses purchased. Sales and partner representatives should determine the correct sizing for each customer deployment so that the appropriate user count is selected. Cisco Commerce (CCW) will dynamically determine the correct price associated with the user count entered.

3. Understanding the quoting and ordering process

3.1 Cisco Duo SKU overview

Orders for Cisco Duo involve four PID/SKU types:

●     The subscription PID is used to define the subscription term and start date.

●     The product PIDs are used to define the products and quantities that make up the subscription.

●     The product add-on PID can only be added on to other product SKUs.

●     The support SKU defines the level of support for the subscription.

Orders start with the selection of the DUO-SUB or DUO-FED-SUB subscription SKU. This is followed by the configuration of the subscription by selecting the product, add-on, and support SKUs that will constitute the subscription.

Subscription SKUs

Cisco Duo SUB (Standard) or FED-SUB (Federal).

Note:      Customers can only purchase FED SKU if approved by Duo.

Standard product packages

Cisco Duo Essentials, Advantage, Premier

Note:      Customers can only purchase one product PID.

Federal product packages

Cisco Duo Essentials, Advantage

Note:      Customers can only purchase one product PID. The end customer must be validated as eligible to purchase the Federal edition. Please begin this validation process by completing this Federal Customer Validation Intake form prior to quoting the customer. A Compliance Hold will be applied to this offer to verify eligibility.

Add-on packages

Add-ons cannot be purchased alone but can be added to existing Cisco Duo products. Availability is based on Service-to Country.

Cisco Duo Technical Support SKUs for ordering

Note:       

1.     Cisco Duo Premium Support is not directly included in any Security Deal Registration Discounts, it is priced as a percentage of the Duo subscription net cost and must have an annual minimum order of $14,000.

2.     Duo products will be on market pricing which differs from pricing on other products within Cisco’s security portfolio.

3.     Duo's Federal edition offers only Basic and Premium level services.

Federal Intake process

The Federal product offers will have a compliance hold on the order. The end customer needs to be determined eligible before provisioning may occur. To determine eligibility, complete and submit the Federal End Customer Validation Intake Form with the appropriate documentation.

4. Ordering process

4.1 Selecting the subscription SKU

There are two Cisco Duo subscription SKUs (DUO-SUB or DUO-FED-SUB). There is no price for the subscription SKU. Pricing is determined when product SKUs are added and configured. User license quantity will be entered when the product SKUs are added to the subscription.

Note:      Each end customer account may have only one active subscription of Cisco Duo.

This means that:

●     Each order may contain only one line item of DUO-SUB or DUO-FED-SUB.

●     Each end customer may have only one active order for DUO-SUB or DUO-FED-SUB.

Attempts to place multiple concurrent orders for DUO-SUB or DUO-FED-SUB or to place an order with multiple line items of DUO-SUB or DUO-FED-SUB will be rejected.

Then “Select Options” to configure.

4.2 Configuration page:

After selecting the subscription SKU, choose Requested Terms and Billing to edit the subscription term and the requested start date.

The subscription term will default to a 12-month term and Prepaid Term Billing. The Requested Start Date may also be changed at this time.

Note:      Annual billing option.

●     Only terms that are 12 to 60 months are allowed (1 to 11 months require nonstandard approval and can only be requested to co-term to another contract greater than 12 months).

●     A Purchase Order (PO) needs to be issued for the full amount, and billing will occur annually before the start date of each service year.

●     While billing is annual, the subscription is for the entire term, and cannot be cancelled mid-term. The service is provisioned, and the subscription starts on the service start date. The provisioning of the service may take up to 72 hours, assuming the order information is complete and correct.

4.3 Selecting the product SKU

●     When the subscription terms have been set, the next step is to add products to the subscription. The duration of the product is defined by the subscription term.

●     Start by selecting the appropriate product in the subscription configuration summary. The guidance below uses Cisco Duo Essentials as an example. Having chosen to configure the subscription for the product, the seller then enters the quantity based on the number of users for the service.

For user-based subscriptions of Cisco Duo, pricing is determined dynamically according to the quantity ordered based on a tiered pricing model. Per-month prices are displayed for the selected PID. However, billing is either annual or prepaid for the term of the subscription, and the term amount is shown in the subtotal.

Note:      Customers can add only one Cisco Duo product package (Essentials, Advantage, or Premier) to a subscription.

Note:      The previously named editions will be visible to support modifications of existing subscriptions. For new business orders, select one of Essentials, Advantage or Premier. For change modify, remove the quantity of the previously purchased edition and put the total desired quantity in one of Essentials, Advantage or Premier.

4.4 Selecting the service SKU

After adding the products, choose the support level desired for the subscription. There are three Cisco Duo service SKUs that correspond to the three levels of support. To configure support for the subscription, select Cisco Duo Support in the subscription configuration summary:

Please note: There is a minimum order amount of $14,000 for Premium Support (Duo Care).

Note:      When ordering a Duo subscription in the CCW, the default support option will vary based on order amount. Orders of approximately $150,000 or greater will default to Cisco Duo Premium Support. To change the service SKU, click "+" next to the SKU needed for the customer's order. Cisco Duo Premium Support, must be coterminous with the Duo subscription.

4.5 Provisioning information

All Duo orders require a purchaser to provide the following end-customer information during order entry to properly provision a Duo account to the end customer.

Note:      The end-customer is the person who will be the Duo Administrator responsible for initially activating and accessing the new Duo account.

●     End-customer Duo Trial account ID, if available, should be provided.

◦    If this information is not provided, a completely new account will be created and will require license transfers.

●     End-customer administrator first name.

●     End-customer administrator last name.

●     End-customer administrator phone number.

●     End-customer administrator email address.

◦    This email address must be correct in order for the administrator to receive their account activation email.

●     End-customer administrator account name.

^*Failure to provide this information will delay the order provisioning process^*

Cisco Duo services will be provisioned, and the subscription will begin on the service start date specified on the order.

Enter the end customer Duo trial account ID (if available, should be provided), first name, last name, phone number, email address and account name of the end-customer administrator (NOT the partner).

After the order has been placed, the provided Duo trial account will be provisioned. If the customer does not have a trial account, a new Duo account will be created for the end customer on the service start date. Partners can also instruct their customer to create a Duo trial account at signup.duo.com prior to placing their order. Upon account creation, the end-customer administrators will receive welcome emails with instructions to log in to the Duo Admin Panel to set up their service. When administrators have logged in to the panel, they will be aided by a setup guide as well as access to support resources in order to make sure their accounts are properly set up.

5. Subscription renewals, changes and cancellations

5.1 Subscription renewals

Cisco Duo subscriptions automatically renew for an additional 12-month term by default. No quoting or ordering is required. Starting 90 days before the end of the initial term, renewal notices will be sent to the purchaser, informing them that their subscription is moving from the initial term to be auto-renewed. The customer or partner will receive an invoice at the start of each new annual term.

Note:      At time of ordering, the subscription is set to auto-renew as a default, however, auto-renew can be turned off (toggle button on lower left as shown above) without triggering the deal to become nonstandard.

5.2 Subscription changes

Customers who purchase on or after December 2, 2019, who would like to change their subscription, must do so via the CCW change subscription portal.

Customers who purchased Cisco Duo before December 2, 2019 can contact duorenewals@cisco.com for further assistance.

Partners can make changes to the products, quantities, or terms of a subscription, at any time during the term of the subscription. To change the subscription, select Cloud/SaaS Subscriptions under the Services and Subscriptions tab. Attempting to add products or seats by creating a new subscription will result in an ordering error.

 

Search for the active subscription and click to see the subscription details. Next, select the Modify/Renew button.

Partners are now able to adjust the products, quantities, start date, and term. To change products or quantities, start by selecting the appropriate product in the subscription configuration summary. The guidance below uses Cisco Duo Essentials as an example. Having chosen the product, partners then enter the quantity based on the number of users for the service.

For a manual renewal or to change the subscription terms, select “Change the terms of my subscription.” For a manual renewal, update the start date to begin one day after the existing subscription’s end date.

5.3 Subscription cancellations

Renewals may be cancelled up to 60 days before the start date of the new term. If the subscription is not cancelled, the subscription will automatically renew. Midterm cancellations of subscriptions for credit are not allowed.

6. Ordering NFR Licenses

Duo NFRs will be available and will follow the standard Cisco NFR process for ordering lab/demo + internal use. Standard PIDs for Essentials, Advantage, and Premier will be utilized for the Duo products within the Cisco NFR program. More details about the Cisco NFR Program can be found at Not for Resale (NFR) - Cisco

Any promotional NFR offers available will be detailed on the Duo Partner Community Page at Cisco Community.

To ensure a smooth, continuous NFR subscription, please turn on “auto-renew” under the Terms tab of the configuration page in CCW:

7. Quoting and ordering help

For quoting or ordering questions, please contact cs-support@cisco.com.

8. Availability

Duo is available globally, except for these countries:

Duo Federal is only available in the US for US based customers, purchasing through the US Availability price list.