In theory it wont be too difficult to script some authentication attempts to a system using valid fake credentials (so that the auth is successful) which are linked to real users, this then would trigger a duo prompt. Then the application name can be...

@user2001 Which text are you referring to? The text that I see in the prompt is just the application name which can be configured in application settings which I assume you can just change each time.

wouldn’t this be possible with ad security groups and application policies to either enforce / allow bypass?

Thanks, it seems like our issue was due to the watchguard vpn server being on a different network to the duo proxy.

Thanks Tab, we had a call with support and worked out that its something to do with the firebox vpn server passing the external ip to the proxy (as its on a different network from the proxy) and then for some reason never getting the auth approved me...