Skip to main content
App security

Category: Identity & Access

Secure Cisco Duo browsing

Cisco Duo can skip MFA on networks you list. Remembered browser sessions can last up to 365 days. Both settings trade friction for exposure.

Quick answer

Duo's Authorized Networks policy can skip MFA for listed networks. The new editor labels it Skip MFA from these networks. Passwordless authentication is not skipped. Remembered devices can skip prompts for up to 365 days. Risk-based remembered devices default to 30 days. Passwordless remembered sessions are capped at 7 days. Keep bypass networks narrow and admin sessions short.

Last updated

2026-10-30

Main browser risks for Cisco Duo

  • Phishing pages that imitate Duo prompts or “verify your account” flows.
  • Session hijacking after authentication via stolen cookies/tokens on compromised endpoints.
  • Push fatigue and social engineering that nudges users into approving unexpected prompts.
  • Authorized Networks ranges so broad that many users skip MFA.
  • Admin console access from unmanaged devices or risky networks.
  • Malicious links encountered during support or troubleshooting that lead to malware or fake updates.

Typical sensitive data in Cisco Duo

  • User enrollment and MFA device registrations.
  • Authentication policies and bypass rules.
  • Trusted device posture and device inventory metadata.
  • Admin roles and access settings.
  • Authentication logs and telemetry.
  • Integration keys and configuration secrets (depending on setup).

Duo authorized networks options

Labels from Duo's policy documentation, last updated October 14, 2026, and checked October 30, 2026. Where ranges overlap, Duo applies the more restrictive setting. Block options also stop Duo apps that do not report client IP.
New policy editorLegacy policy editorEffect
Skip MFA from these networks (passwordless authentication is not skipped)Allow access without 2FA from these networksUsers on listed networks bypass Duo secondary authentication. New users also skip enrollment unless you require it.
Require MFA from these networks every time, even if it would normally be skippedRequire 2FA from these networksRequires Duo secondary authentication on listed networks, even over remembered device trust.
Block access from these networksDeny access from these networksDenies access from listed networks and overrides the skip and require options.
Block access from any other network not specified aboveDeny access from any other network not specified aboveDenies access from every network you did not configure.

Labels from Duo's policy documentation, last updated October 14, 2026, and checked October 30, 2026. Where ranges overlap, Duo applies the more restrictive setting. Block options also stop Duo apps that do not report client IP.

Recommended controls by role

IT Admins

  • Use a dedicated browser profile for Duo admin access.
  • Keep Authorized Networks ranges narrow and review them often.
  • Exclude admin apps from MFA bypass policies.
  • Shorten remembered device windows for high-risk apps.

Security

  • Treat unexpected push approvals as security incidents.
  • Watch for policy changes and spikes in bypass use.
  • Investigate suspicious “verify” pages in an isolated browser.

Contractors

  • Use isolated browsing for risky links on personal devices.
  • Limit session duration and require re-auth for sensitive access.
  • Block unapproved extensions and risky permission prompts.

Where Shield fits with Cisco Duo

The controls above are general security practices, not Legba features. Cisco Duo is not a Legba integration.

Legba's part is narrow. Shield opens a page in an isolated browser off your device. Use it for a link you do not trust.

Limits

Shield moves page execution off your device. Downloads and copied data still cross that boundary. It cannot stop you sharing passwords with unfamiliar sites. Treat downloads and sign-in prompts with care.

Add to Chrome

Free for 30 days. No card required.

Cisco Duo security questions

What does Duo's Authorized Networks policy do?
It changes MFA by network. You can skip MFA or require it every time. You can also block listed or unlisted networks. The skip option does not skip passwordless authentication.
Is skipping MFA on trusted networks safe?
It trades protection for convenience. Anyone on a listed network skips the second factor. So does a compromised device on that network. Keep ranges narrow. Exclude admin apps from bypass policies.
What is the longest Duo remembered device session?
Browser-based apps allow up to 365 days. Risk-based remembering defaults to 30 days. Passwordless sessions cap at 7 days, whatever you configure.
Does Duo protect against session theft after MFA?
Duo checks the sign-in itself. A session token stolen afterward is a separate risk. Long remembered sessions widen that window. CISA also warns about push bombing against push-based MFA.
Should Duo admins use a separate browser profile?
Duo admin sessions can change bypass rules and policies. Keep them apart from email and general browsing.

References

  1. 01
    Duo: Policy and control documentationCisco
  2. 02
    CISA: Implementing phishing-resistant MFA (October 2022)CISA
  3. 03
    Chrome Enterprise: PoliciesGoogle

Keep exploring

Try it on the next page you do not trust

Legba is a Chrome extension with two modes. Ghost gives you a private browser route. Shield opens a page in an isolated browser off your device.

Add to Chrome

Free for 30 days. No card required.

Ghost. A private route for your browser. Shield. An isolated browser, off your device. Choose the mode. Close when finished.