Duo Universal Prompt

When you log into an application protected with Duo using a web browser or certain client applications, you see a Duo prompt after entering your application login information.

The Universal Prompt provides a simplified Duo experience over the traditional prompt, helping you log in to your applications faster than before.

You'll notice that the Duo login options look different from how they did in the traditional prompt, but the Universal Prompt still supports a wide range of Duo login options so you (or your Duo administrator) can choose the options that work best for your organization.

Another difference between the Universal Prompt and the traditional prompt is that the traditional prompt loads on a web page that's part of your organization's application, while with the Universal Prompt your browser redirects to a page hosted by Duo for you to verify your login attempt, and then redirects back to the application.

Here's a comparison of logging in with Duo Push in the Universal Prompt and traditional prompt:

Universal Prompt	Traditional Prompt

Supported Browsers

The Universal Prompt supports Chrome (Desktop and Mobile), Firefox, Safari (Desktop and Mobile), Edge, and Internet Explorer. Not all browsers support all Duo authentication methods, so for the widest compatibility we recommend Chrome.

Check the table below for supported browser versions and Duo login option compatibility. Platform and roaming authenticators may require a different browser or a newer minimum browser version, please refer to WebAuthn Browser Support. Duo's support for the minimum browser version includes Duo Push, passcode, and phone call authentication options.

Browser	Minimum Supported Version
Chrome	38
Safari	9
Firefox	47
Edge	17
Internet Explorer	11

While other browsers may work with the Universal Prompt, Duo actively tests and supports the browsers and minimum versions listed in the table.

When you log in Duo checks your current browser or client compatibility with the Universal Prompt. If your browser or client is not compatible, Duo will show you the traditional prompt experience instead.

WebAuthn Supported Browsers

Check the tables below for supported browser versions for platform authenticators (like Touch ID, Face ID, Windows Hello, or Android biometrics) and roaming authenticators (like security keys). While other browsers may work, Duo actively tests and supports the browser minimum versions listed in the tables.

Windows 10 and Later

Browser	Minimum Supported Version	Platform Authenticator	Roaming Authenticator (Security Keys)
Edge	79	Yes ¹	Yes
Chrome	73	Yes ¹	Yes
Firefox	66	Yes	Yes

Windows Hello is not supported in Chrome Incognito or Edge InPrivate browsing sessions.

macOS 11 and Later

You must sign in with the same iCloud account and enable iCloud Keychain sync on all the Apple devices you plan to use with Duo and passkeys. See the iCloud documentation for instructions specific to your device types:

Browser	Minimum Supported Version	Platform Authenticator	Roaming Authenticator (Security Keys)
Safari	14	Yes	Yes
Chrome	70	Yes	Yes
Firefox	122	Yes	Yes¹

Firefox on macOS cannot prompt to create a security key's PIN. Security keys that already have a PIN set can be used to authenticate in Firefox.

iOS/iPadOS 14.5 and Later

Browser	Minimum Supported Version	Platform Authenticator	Roaming Authenticator (Security Keys)
Safari	14.5	Yes	Yes
Chrome	95	Yes	Yes
Edge	95	Yes	Yes
Firefox	38	Yes	Yes

Android 10 and Later

Browser	Minimum Supported Version	Platform Authenticator	Roaming Authenticator (Security Keys)
Chrome	95	Yes	Yes
Firefox	68	Yes ¹	No

Firefox on Android 10 and 11 does not support Android biometric enrollment.

Linux

Linux has no supported platform authenticators.

Language Support

Your browser's language settings determine the language shown in the Universal Prompt, with no extra configuration necessary.

When the Universal Prompt displays English, Spanish, French, German, or Japanese, phone callback authentication will use the same language shown in the prompt.

Catalan, Chinese (Simplified), Chinese (Traditional), Czech, Danish, Dutch, Finnish, Hindi, Indonesian, Italian, Korean, Norwegian, Polish, Portuguese (Brazil), Portuguese (Portugal), Swedish, Thai, Turkish, and Vietnamese languages will display in the Universal Prompt, but phone callback authentication will be in English.

After completing Duo enrollment (or if your Duo administrator already set you up to use Duo), you'll see the Duo prompt the next time you perform a browser-based login to a web service or application protected with Duo.

The first time you log in to an application with Duo using the Universal Prompt, Duo may choose one of your configured login options automatically, selecting the most-secure method from the ones you have available.

If your organization's Duo administrator turned off automatic authentication method selection, you'll choose one of your available methods to continue authentication. We recommend selecting the most-secure available option.

Duo authentication methods from most to least secure:

Platform authenticators
Roaming authenticators
Verified Duo Push
Duo Mobile push approval
YubiKey passcodes
Duo Mobile generated passcodes
Hardware token passcodes
SMS passcodes
Phone call approval

Duo considers platform authenticators and roaming authenticators to be the most secure authentication methods, so if you have set up either of these methods and the application allows their use you'll automatically be prompted to use your platform authenticator (like Touch ID) or roaming authenticator (like security key) the first time you log into that application.

The next most secure Duo method is using Duo Mobile to approve push notifications. If you do not have a platform authenticator or roaming authenticator available, but you do have a phone or tablet with Duo Mobile activated, the Universal Prompt may automatically send you a Duo Push the first time you log in to that application. You may also have to enter a code into Duo Mobile to approve the push request if your organization requires it.

If you haven't set up Duo Mobile, then the Duo Universal Prompt may automatically select your next available option, following the most to least secure preference order.

If you don't want to use the method Duo automatically suggests for that application, cancel the Duo authentication in progress and click or tap Other options. Then, select the method you want from the list.

Completing Duo login sets the login option you used as the first choice for this application. Future Universal Prompt logins to that application from the same device and browser may automatically use that same method. If you cancel the authentication in process and choose a different device, then the device you use becomes the first choice for that application.

There is no way to turn off automatic device selection yourself, or to explicitly configure a default authentication device. Contact your organization's Duo administrator or help desk to determine whether they can change your automatic device selection setting.

Your organization's Duo administrator may choose to block some authentication options for certain applications, requiring that you choose a different device. Since Duo remembers the last-used authentication device for each application you access, the Universal Prompt should always display the right default option for that application.

Authentication methods are shown in the following order when on a mobile device:

Verified Duo Push
Duo Mobile push approval
Duo Mobile generated passcodes
SMS passcodes
Phone call approval
Hardware token passcodes
Platform authenticators
Roaming authenticators
YubiKey passcodes

Choose a Different Method

If you ever want to choose a different device or Duo method than the one chosen automatically by the Universal Prompt, or want to cancel an authentication in progress to select a different method, click Other options near the bottom. This takes you to a list of all your available Duo authentication options. Click on the one you want to use and follow the instructions shown to complete logging in to the application.

List of Authentication Options in Universal Prompt

The Universal Prompt shows a drop-down filter near the top when you have seven or more devices. The filter choices show phones you have enrolled using the last four digits of your number, hardware tokens, and security keys. Use the filter to select the device you want to use for authentication, then choose from the available methods for that device to continue. Set the filter to show all your devices to choose platform authenticators and passkeys, like Touch ID or Windows Hello.

Authentication Options Filter in Universal Prompt

Your organization might apply a policy that prevents the use of some authentication methods for one or all applications. If so, those options won't show up in the list.

Remembered Devices

If your organization's policy allows it, you may be able to skip authenticating with Duo again for a set amount of time. The first time you approve the Duo authentication request, you'll see the option to remember your device.

Choose Yes, this is my device to create a trusted device session that will let you skip Duo two-factor authentication when you log in again with the same browser and device until that remembered device session expires.

Depending on the policy applied by your Duo administrator, this may remember your device across all your organization's Duo-protected applications, or there may be unique policies applied to applications that require you to perform Duo authentication again regardless of whether you remembered the device. Ask your Duo administrator or help desk for more information.

Do not trust the device when using a public or shared computer! This could leave your Duo session available to other users. Remember the device only when you access applications from your own computer.

Clicking on No, other people use this device will not create a trust session. You won't be asked to remember that device again for 14 days.

First-Time Device Trust Option in Universal Prompt

When your trusted browser session expires, you will need to use two-factor authentication again. Duo Push, phone call, text message, and passcode authentication methods will show the option to remember the device already enabled for you. Leaving the option enabled creates a new remembered device session.

If you don't want to remember the device anymore, uncheck the Remember me box before you approve the Duo Push or phone call request or enter a passcode.

Remembered Device Option for Duo Push

If you log in automatically with a WebAuthn method like Touch ID, a passkey, or a security key you won't see the Remember me option on the page. You will need to cancel the Duo authentication in progress if you don't want to remember that device anymore. This sends you back to the page where you can uncheck the Remember me box and then try to log in again.

Remembered Device Option for Touch ID

Availability of the following Duo login options in the Universal Prompt depends on your browser or browser version, or on the policies applied by your organization's Duo administrator.

Platform Authenticators

Platform authenticators are authentication methods built into the device you use to access services and applications protected by Duo. Examples of platform devices would be Touch ID on Mac, Face ID on an iPhone, Windows Hello, and Android biometrics.

Touch ID on Mac

In order to use Touch ID with Duo, make sure you have the following:

A MacBook Pro, MacBook Air, or Magic Keyboard with a Touch ID button.
A fingerprint enrolled in Touch ID (see how to do this at the Apple Support site).
A supported browser: Safari or Chrome. Refer to the browser support table.
iCloud Keychain sync enabled on all the Apple devices you will use with Duo and the passkey you will create during setup.

Touch your Mac's Touch ID sensor when prompted to log in to the application. If you aren't able to access the Touch ID sensor (such as when you close and dock your laptop), then you can choose to type in your Mac login password instead to verify.

Touch ID in Universal Prompt

If you need to cancel a Touch ID authentication in progress, click or tap the cancel option shown by your browser, outside of the Duo Universal Prompt.

Face ID or Touch ID on an iPhone or iPad

In order to use Face ID or Touch ID on an iPhone or iPad with Duo, make sure you have the following:

An iPhone or iPad that supports Face ID or Touch ID.
Face ID or Touch ID already set up on the iPhone or iPad. Learn how to set up Face ID or set up Touch ID at the Apple Support site.
iCloud Keychain sync enabled on all the Apple devices you will use with Duo and the passkey you will create during setup.

Depending on the option your device supports, you'll either scan your face to use Face ID while logging in, or you'll scan your fingerprint instead to use Touch ID.

Windows Hello

In order to use Windows Hello with Duo, make sure you have the following:

A device running Windows 10 or later.
Windows Hello set up on the device for signing in with a PIN, fingerprint, or facial recognition. Learn how to set up Windows Hello at the Microsoft support site.
A supported browser: Chrome, Edge, or Firefox. Refer to the browser support table. Note that Chrome Incognito and Edge InPrivate browsing won't work with Windows Hello, but will work with Security Keys.

Follow your device's prompt to enter your Windows Hello PIN, scan your fingerprint, or use facial recognition to log into Duo.

Android Biometrics

In order to use Android Biometrics with Duo, make sure you have the following:

An Android device that supports biometrics, like fingerprint or face unlock.
Facial or fingerprint unlock set up on that device. Go to Settings → Security to change your unlock settings. Refer to the Google support articles Unlock your Pixel phone with your fingerprint and Unlock your Pixel phone with your face, the Samsung articles Set up and use the fingerprint sensor on your Galaxy phone and Use Facial recognition security on your Galaxy phone, or your device manufacturer's support site for examples of how to do this.

Follow your device's prompt to scan your fingerprint or use facial recognition to log into Duo.

Additional Passkey Registration

If you had to cancel authentication because your enrolled passkey isn't available on the access device you're using now, you may be presented with the option to try again or enroll another passkey.

The following example shows how to setup Touch ID on a Mac. These steps are the same for other platform authenticators such as Face ID/Touch ID on an iPhone or iPad, Windows Hello, or Android Biometrics.

Click Set up Touch ID.
Click Continue and follow the instructions to setup the new passkey (Touch ID on Mac, Face ID/Touch ID on an iPhone or iPad, Windows Hello, Android Biometrics)

Roaming Authenticators

Roaming authenticators are WebAuthn FIDO2 security keys, like those from Yubico or Feitian. They can move from one system you use to access services and applications protected by Duo to another, such as a USB security key you unplug from one laptop and plug into another.

Security Key

A security key plugs into your USB port and when tapped or pressed it sends a signed response back to Duo to verify your login. Duo uses the WebAuthn authentication standard to interact with your security keys. You may also see WebAuthn referred to as "FIDO2".

In order to use a security key with Duo, make sure you have the following:

A supported browser (check the table above to verify your browser supports security keys).
An available USB port.
A WebAuthn/FIDO2 security key. WebAuthn/FIDO2 security keys from Yubico or Feitian are good options. U2F-only security keys (like the YubiKey NEO-n) are not supported.

If your organization requires user verification of your security key with a PIN or biometric then your security key must support FIDO2.

Insert your security key if not already plugged in, and then tap or press your security key when prompted to log in to the application. Some types of keys flash as a prompt for you to authenticate. Your browser may also pop up a prompt instructing you to tap your security key.

Security Key in Universal Prompt

You need to interact with the prompt to use a security key from Safari browser on macOS or any browser on iOS. Click or tap the Use security key button and then tap or press your security key.

Security Key in Universal Prompt in Safari

If your organization requires user verification you'll need to enter your PIN or scan your biometric as well (Chrome example shown).

Security Key Prompt with PIN User Verification

If you need to cancel a security key authentication in progress, click or tap the cancel option shown by your browser, outside of the Duo Universal Prompt.

YubiKey Passcode

Log in using a passcode generated by a YubiKey. Connect or plug in your YubiKey and press it to generate and submit a passcode to log in to the application.

Your administrator must have configured the YubiKey for passcode use in Duo. This is a separate function from using a YubiKey as a security key.

YubiKey Passcode in Universal Prompt

Duo Push

Pushes a login request to your iOS or Android phone or tablet if you have Duo Mobile installed and activated. Review the request on your phone or tablet and tap Approve to log in to the application.

Duo Push in Universal Prompt

Verified Duo Push

Your organization may wish for you to enter a verification code shown within the Duo Universal Prompt into Duo Mobile when you approve a Duo Push request. This protects you from approving login requests not made by you and helps keep your accounts and information safe.

If your organization requires Duo Push verification, Duo Universal Prompt displays a numeric code three to six digits in length on-screen when you choose to use Duo Push to log in to that application.

Duo Push Verification Code in Duo Universal Prompt

Enter the code shown on your screen into the Duo Push request received on your Android or iOS device. Android users only: tap Verify to finish approving the login request.

If your installed Duo Mobile version does not support verification then you will receive a Duo Push request without the code entry field. If you try to approve then the login fails and you'll see a message instructing you to update your software. Use a different allowed authentication method or contact your help desk.

Duo Mobile Passcode

Log in using a passcode generated by the Duo Mobile app installed and activated on your Android or iOS device. Open Duo Mobile and locate your organization's account in the accounts list, and tap it to generate a six-digit passcode. Enter that passcode into the space provided and click or tap Verify to log in to the application.

Duo Mobile Passcode in Universal Prompt

Text Message Passcode

Log in using a passcode received from Duo in a text message. When you land on the text message page, it will show that a text message was just sent to you with a passcode. When you receive the message, enter that passcode into the space provided and click or tap Verify to log in to the application. When authenticating from a mobile device in the United States and Canada your browser may automatically enter the passcode for you.

If you did not receive the text message from Duo, use the Send a new passcode link to try sending it again.

Passcodes received in a text message expire when used.

Text Message Passcode in Universal Prompt

Phone Call

Authenticate via phone callback. Answer the phone call from Duo and follow the voice instructions to log in to the application.

Phone Call in Universal Prompt

Hardware Token Passcode

Log in using a passcode generated by a hardware token provided to you by your organization. Enter that passcode into the space provided and click or tap Verify to log in to the application.

Hardware Token Passcode in Universal Prompt

Bypass Code

Log in using a code provided by your organization's Duo administrator or help desk. Enter that code into the space provided and click or tap Verify to log in to the application.

Bypass Code in Universal Prompt

First-time Enrollment in Duo

Enrollment is the process that registers you as a user in Duo with a device capable of performing two-factor authentication. Duo prompts you to enroll the first time you log into a protected VPN or web application when using a browser or client application that shows the interactive Duo web-based prompt. Follow the on-screen prompts to set up your Duo authentication device.

Instead of enrolling when you log in to an application, you might receive an email from your organization's Duo administrator with an enrollment link instead. This emailed link takes you directly to the Duo enrollment portal. You'll see either the Universal Prompt experience shown on this page or enrollment in the traditional Duo prompt depending on your organization's email enrollment configuration.

Step One: Introduction

Logging into a Duo-protected application enabled for self-enrollment takes you to the device management page to enroll. Click Next to learn why protecting your identity with two-step verification is important and begin the setup process.

Begin Universal Enrollment

Step Two: Choose Your Verification Method

Choose the device type in the list that matches your desired authentication experience:

Touch ID: Use the fingerprint sensor on Apple MacBooks, Magic Keyboards, or iPhone.
Face ID: Use the face scanning feature on iPhone.
Windows Hello: Use your Windows Hello PIN, scan your fingerprint, or use facial recognition on Windows devices.
Device verification: Use Android Biometrics on Android devices.
Duo Mobile: Approve Duo Push verification requests on iOS or Android devices, or generate a one-time passcode from the Duo Mobile app.
Security key: Tap a WebAuthn/FIDO2 security key. Requires Chrome, Safari, Firefox, or Edge.
Phone number: Receive a one-time passcode in an SMS message or approve a login attempt with a phone call from Duo.

Only your organization's Duo administrator or help desk can add hardware tokens and YubiKey OTP tokens for you. These verification options do not show up in the list of available options. Neither do any methods that your organization blocks from use; if your Duo administrator applied a policy that doesn't allow authentication with text messages or phone calls, the "Phone number" option will be missing when you enroll.

Duo recommends the most secure option of the methods available to you, so it's a good idea to set up that method first if you have a device that supports it.

This is an example of the options on a MacBook with Touch ID available:

Select Identity Verification method