Hello everyone! Here are the release notes for our most recent updates to Duo.
Public release notes are published on the Customer Community every other Friday, the day after the D-release is completely rolled out to commercial deployments. You can subscribe to notifications for new release notes by following the process described here. Check the Duo cloud service release version for your Duo account from the Duo Admin Panel.
If you have any questions about these changes, please comment below.
Review the Guide to Duo End-of-Life and End-of-Support Plans. This guide provides an up-to-date list of current and past end-of-life plans for Duo products.
- Cisco Duo
- LDAPS End-of-Life Milestone Reached
- New Features
- Now Generally Available: Duo Passport Multi-User Support
- Now Generally Available: Verified Duo Push for Windows logons
- Now Generally Available: Passwordless OS Logon and support for enabling OS Passwordless for groups
- “Permitted Groups” is now “User access”
- Duo Wear App for Android Watches
- Enhancements
- New and Updated Applications
- Six new named applications with Duo Single Sign-On (SSO)
- Duo Authentication for Windows Logon v5.0.0 released
- Duo Desktop public beta 7.4.2 for Windows released
- Duo Desktop public beta 7.4.2.0 for macOS released
- Duo Mobile for Android version 4.83.0 released
- Duo Mobile for iOS version 4.83.0 released
- Identity Security
- New Features
- New Check: User Trust Level Alert
- Enhancements
Cisco Duo
LDAPS End-of-Life Milestone Reached
The Duo LDAP cloud service used to provide two-factor authentication via direct LDAPS connection for Cisco ASA, Juniper Networks Secure Access, or Pulse Secure Connect Secure SSL VPN logins reached end of life on February 20, 2025. See more details about this end-of-life plan in the Duo Knowledge Base.
New Features
Now Generally Available: Duo Passport Multi-User Support
- This enhancement allows multiple Passport users on shared devices. Passport securely verifies that the device’s logged-in user matches the browser user with an active Passport session. If no match is found, the logged-in user will be prompted to authenticate again.
Now Generally Available: Verified Duo Push for Windows logons
- General availability of Verified Duo Push support for Windows logons when the authentication methods policy requires Verified Duo Push with a verification code.
Now Generally Available: Passwordless OS Logon and support for enabling OS Passwordless for groups
- Users may log in securely to Windows via Bluetooth connection to a mobile device with Duo Mobile platform biometric or PIN verification instead of entering a password.
- It is now also possible to restrict which user groups may use Passwordless OS Logon from the Duo Admin Panel.
“Permitted Groups” is now “User access”
- We're changing how you configure allowed group access to Duo applications. The "Permitted Groups" application setting has been renamed to "User access" and relocated to the top of the application details page in the Duo Admin Panel. The options for that setting have changed as well, letting you manage application access by enabling it for all users, specific groups, or disabling it entirely.
- In a future Duo release the user access default setting for newly-created applications will default to "Disable for all users", adhering to least privilege access practices. When this happens the user access permissions for your existing applications will remain unchanged. I
Duo Wear App for Android Watches
- We’ve released a companion app to Duo Mobile for Wear OS devices. This app lets you generate passcodes, view push metadata, and approve Duo Pushes and Verified Duo Pushes.
Enhancements
- Passwordless: When a customer that has already activated passwordless creates a new policy, all passwordless authentication methods will now default to being off.
New and Updated Applications
Six new named applications with Duo Single Sign-On (SSO)
- There are now five named SAML applications to protect Cisco Secure Access, Honeycomb, OneSpan, Red Canary, Scoro, and one OIDC application to protect WorkOS with Duo Single Sign-On (SSO), our cloud identity provider.
Five existing SSO applications with enhanced attribute support so that name ID attribute shows as custom attribute
Duo Authentication for Windows Logon v5.0.0 released
- General availability of Passwordless OS Logon. Users may log in securely to Windows via Bluetooth connection to a mobile device with Duo Mobile platform biometric or PIN verification instead of entering a password.
- It is now possible to restrict which user groups may use Passwordless OS Logon from the Duo Admin Panel.
- Cancelling a Passwordless OS Logon push now immediately cancels the push in progress rather than simply dismissing the Passwordless push dialog but waiting for the push to time out.
- General availability of Verified Duo Push support for Windows logons when the authentication methods policy requires Verified Duo Push with a verification code.
- Improved handling of updates to offline policies.
- Improvements to the Windows password reset experience.
- Adds support for Windows Server 2025 and removes installer support for Windows 2012 R2 and earlier.
Duo Desktop public beta 7.4.2 for Windows released
- Improved logging in the event of a failed connection from Cisco Secure Client.
- Internal changes to support using CrowdStrike agent identifiers for trusted endpoints.
Duo Desktop public beta 7.4.2.0 for macOS released
- Removed support for macOS 10.15.
Duo Mobile for Android version 4.83.0 released
- Miscellaneous bug fixes and behind-the-scenes improvements.
- Duo Wear support.
Duo Mobile for iOS version 4.83.0 released
- Miscellaneous bug fixes and behind-the-scenes improvements.
Identity Security
New Features
New Check: User Trust Level Alert
- Identity Intelligence’s User Trust Level helps quickly identify the riskiest users in your organization based on a combination of different user data. With this new check, User Trust Level Alert, the users who have received a level of Untrusted will fail and you can configure a notification target on the check to proactively receive notifications about these users.
- The check’s settings can also be modified to include users who receive a trust level of Questionable.
Enhancements
- Identity Intelligence can now see information about non-interactive Entra ID sign ins. Previously the last successful sign in date displayed on the user’s Entra ID source card in the User 360 only displayed successful, interactive sign ins. Now, this date could also represent a successful, non-interactive sign in. Non-interactive sign ins will also be considered when determining a user’s activity status (Active vs Inactive), as well as when evaluating sign in activity for checks like Never Logged In and Inactive Users.
