Hi @PORBAR
Yes Duo should be able to work with what you are looking for, however I wouldn’t think about it as protecting the app or email client, rather it is protecting the email account from the server (in this case O365).
There are a couple of options on how to setup Duo with O365, I would recommend using the Conditional Access route, as this is the easiest to implement (in my opinion) and also the most flexible. The one drawback to it is that it may be more expensive as you will need Azure AD P1 licenses (or equivalent like M365 Business Premium).
Alternatively there is the Duo SSO route, however that would require On Prem AD as your primary authentication, and AD Sync between Azure AD and On Prem.
I hope the helps.
