Disable MFA for RDS and not RDP

[michael-leal]

Is there a way to not prompt for MFA when an RDS session(Citrix VDA) is launched and prompt when connecting via RDP?

[DuoKristina]

Where do you have Duo configured in this scenario, which specific Duo application have you deployed, and if at both Citrix and the Windows host which of the two do you not want to prompt?

[michael-leal]

Duo is only configured on the RDS server with the Duo RDP Application. I only want Duo to prompt if an RDP session is established and not an application being launched via Citrix RDS. 

[DuoKristina]

I forget if the Citrix app session is seen by Windows as an RDP login or as a local console login (my experience with Citrix is from the ICA era). If the Citrix app session is seen by Windows as local console, you can edit the registry to require Duo only for RDP connections with RdpOnly=1. Learn more here: https://help.duo.com/s/article/1084?language=en_US

[michael-leal]

Support ask me to try that and it didn't work.  Support came to the conclusion that Duo is not going to work in this situation.