Duo Authentication for AD FS - Release Notes

Last updated: June 25th, 2025

Download the current release from the Checksums and Downloads page.

AD FS for Windows 2016 and later

Adds the new Duo Secret Key Rotation tool in the AD FS installation directory to assist administrators with updating the application's Client_Secret to a new value when required.
The Client_Secret is encrypted in the Windows registry. Previously, the Client_Secret was saved as clear text in the registry.
Product installer updated to use WiX Toolset tooling. Previous releases used Advanced Installer.
Adds support for Windows Server 2025.
The Duo AD FS 2.3.0 installer restarts the AD FS service prior to exiting. The restart is required if upgrading from a previous version of the Duo AD FS MFA adapter. If any errors are displayed during installation, you may need to manually restart the AD FS service after install completion.

Adds support for AD FS OIDC Application Group applications.
Updates the ADFS-Diag.ps1 support script to collect information about Application Groups and .NET Framework strong cryptography configuration.

Corrects an issue where some IE 11 authentications encountered Javascript syntax errors.
Corrects an issue in the ADFS-Diag.ps1 support script bundled with the previous release where the application's client secret value may have been collected with other system information.
Improved client logging.

Duo Universal Prompt support with OIDC standards-based redirects. The Duo Prompt no longer loads in an iframe. Learn more about the move to frameless authentication in preparation for Duo Universal Prompt.
Validated support AD FS on for Windows Server 2019 and 2022.
The installer now defaults to "fail closed" for net new installations. Upgrades preserve the previous fail mode selection.
The installer now defaults to TLS 1.2 communications with Duo's service when verifying the application information. The silent install workaround for TLS 1.0 required in previous versions is no longer needed.
Duo files now use SHA-256 signing.
The Duo AD FS support script is now bundled with the installer. Use this script at the direction of Duo Support.
Corrected an issue where the Duo for AD FS application's registry entries may be corrupted after a repair installation.
Corrected an issue where the installer created a duplicate registry entry for Duo.
Changes the Duo AD FS registry key location to HKLM\Software\Duo Security\DuoAdfs and the registry values IKey and SKey to Client_Id and Client_Secret.