Setting Up Duo Mobile App as an MFA Proxy: A Comprehensive Guide

Introduction

----------

With the rise in remote work and cloud computing, securing access to sensitive resources has become increasingly important than ever before. One effective method for enhancing security is implementing two-factor authentication (2FA) through a multi-factor authentication (MFA) proxy like Duo Mobile App.

This article will walk you through the process of setting up Duo as an MFA proxy using Windows 10/11 and Windows Server 2016/2019/2022. We'll cover all necessary steps, from installing and configuring the required components to integrating Duo with Active Directory Federation Services (AD FS) Identity Provider and/or Web Application Proxy.

Prerequisites

----------

Before proceeding further, ensure that you meet these prerequisites:

1. You have a valid Windows 10/11 or Windows Server 2016/2019/2022 operating system installed on your machine.

2. Duo Mobile App is downloaded and installed from the official Microsoft Store or directly from 'Duo's download page'(https://www.duosecurity.com/products/client).

3. You have a working Internet connection to access online resources.

Step 1: Enrolling Users in Duo

-----------------------------

To use Duo as an MFA proxy, you must first enroll at least one user under your organization's account using the self-service enrollment process or by manually enlisting them through the 'Duo Admin Console'(https://www.duosecurity.com/developer/clientlibraries#/gettingstarted). If a user attempts to log in without prior enrollment, they will encounter an error message similar to this:

```bash

Error: You have not completed Duo two-factor authentication.

```

Follow these steps to enroll users manually through the Admin Console:

1. Log into your 'Dduo Control Panel'(https://www.duosecurity.com/).

2. Click on Users from the left-hand navigation menu.

3. Locate the user you want to add and click their name or profile picture next to them.

4. Scroll down until you see ' Duo Mobile' under the Authenticator section.

5. Select either Send me a text message (SMS), Get an authentication code via email, or Generate a QR code depending on your preferred enrollment method.

Once enrolled successfully, users will receive instructions via their chosen communication channel to complete the 2FA setup process using Duo Mobile App on their device(s).

Step 2: Configuring AD FS and/or Web Application Proxy

-------------------------------------------------------------

After enrolling at least one user in Duo, you're ready to proceed with configuring your environment for MFA. This involves:

1. Installing and enabling the 'ADFS MFA'(https://docs.microsoft.com/en-us/azure/active-directory/authentication/how-to-configure-authentication-methods) feature on each Windows Server instance that will act as an Identity Provider or Web Application Proxy.

To do this, follow these steps for a clean installation of AD FS:

1. Open PowerShell with elevated privileges.

2. Run the following command to install and configure all required components: `Install-WAProxy -Mode IWA`

3. Once completed successfully, restart your computer.

Alternatively, if you already have an existing AD FS infrastructure in place but haven't yet enabled MFA for it:

1. Open PowerShell with elevated privileges.

2. Run the following command to enable MFA on all Web Application Proxy servers: `Set-WebApplicationProxyAuthentication -Mode IWA`

Step 3: Configuring Duo as a Federation Service

------------------------------------------------

Now that you have AD FS and/or Web Application Proxy set up for MFA, it's time to integrate them with your existing Active Directory infrastructure using the 'Duo ADFS Connector'(https://www.duosecurity.com/developer/clientlibraries#/gettingstarted).

Here are the steps:

1. Download and install the Duo ADFS connector from this link:

2. Follow these instructions carefully to configure the connector:

- Run `.\Setup-Connector.ps1` as an administrator in PowerShell.

- Enter your Client ID, Secret Key, Realm Name (also known as Tenant Name), and Redirect URI when prompted.

After completing all of these steps correctly, users should now see a Duo two-factor authentication prompt upon attempting to log into protected resources via AD FS or Web Application Proxy:

```bash

Duo Two-Factor Authentication Prompt

Enter the 6-digit code from your mobile device:

```

Troubleshooting Common Issues

--------------------------------

If you encounter any issues during this process, here are some common troubleshooting tips that might help resolve them quickly:

1. Ensure that time on all machines is set correctly and synchronized using NTP (Network Time Protocol).

2. Double-check the Duo Client ID/Secret Key values entered in both your AD FS/IIS config files (.config/.xml) and within Duo's Admin Console.

3. Make sure there are no firewall rules blocking communication between client devices, Web Application Proxy servers, or Active Directory Federation Services instances.

-------

By following this step-by-step guide to set up the Duo Mobile App as an MFA proxy for your organization's AD FS infrastructure using Windows 10/11 and/or Server 2016+, you've significantly enhanced security posture against unauthorized access attempts. Remember that a strong password alone is no longer enough; implement two-factor authentication today with Duo!