MFA twice to MFA once per laptop location

[pdz]

Morning All:

I am deploying laptops with MFA to log into the laptop as a security protection.  I want to remove the current need to MFA into the Remote Server.  Primarily this causes frustration on the part of the end user.  I am unable to locate a setting or work arouns.

[DuoKristina]

Some ideas:

1. Uninstall Duo MFA from the remote server (I don't really recommend this but just putting it out there).
2. Apply a Duo policy to the server RDP integration that sets new user policy to deny unenrolled and the authentication policy to bypass MFA - so only users who exist in Duo can log into the server - but there is no dependency on them having actually completed MFA at a laptop.
3. Apply a Duo policy to the server RDP integration that sets an authorized networks policy so that if the MFA's laptops connect to some specific network they can bypass MFA at the server.

Duo policy info 

You may have read about Duo Passport, which can use information from an initial Windows OS login using Duo to SSO into SSO and web apps that show the browser-based Duo MFA prompt. That doesn't apply here. We don't yet have any options for detecting MFA completed on a system with Duo for Windows Logon installed and passing that info on to bypass MFA into a subsequent access of a different Windows system that also has Duo for Windows Logon installed.

[pdz]

Thank you for the information.

I beta 2 and 3 with groups to see what reactions I receive.

I will review the Passport and again beta that as well.

Thank you for your time.

[DuoKristina]

OK, just noting again Duo Passport will NOT solve this for you because it doesn't pass Windows OS login MFA on to Windows Logon on a different machine.

But, if you also protect browser-based apps like Office 365, etc with Duo, Passport will make signing into those apps easier for your users.

https://duo.com/docs/passport