O365 login with Duo for thin client users with no mobile device

[Jaimer00]

Hi, is there options to provide Duo authentication for O365, for users that use thin clients with non-persistent desktops and do not have access to a company mobile device.  They may have their own mobile, but I don't want them to use that.  Is there some type of application from Duo or other that I can install onto the Gold image of the VDI that can facilitate the MFA?

Thanks.

[kyle-kyle]

have you considered using passkeys? something like a yubikey or swissbit might work. 

[Jaimer00]

I'm trying the Yubikey Nano5 right now, but it looks like I have to enable TPM on the vm's.  I'm not sure if my current hardware supports that and if it does, looks like I'll have to cook up a new Gold Image.

[kyle-kyle]

You might want to explore Duo's web SDK

The Duo Web SDK is a JavaScript library that can be integrated into your O365 login pages. This allows users to perform Duo Push, Duo Phone, or other Duo authentication methods directly within their web browser on the thin client.

or check if the  YubiKeys can still be used as hardware tokens for 2FA, even without relying on TPM for passkey functionality

check with your hypervisor vendor. Good luck

[kyle-kyle]

here's the link to the Duo SDK info

https://duo.com/docs/duoweb#overview