Contents
Overview
You can provide Duo with visibility into your organization's devices and their security posture by connecting to your choice of non-intrusive data sources. Choose between data provided by Duo Desktop or by Chrome Enterprise browsers.
Device Data Sources is part of the Duo Advantage and Duo Premier plans.
Duo Desktop
No additional configuration needed to use Duo Desktop as a device data source.
See Duo Desktop for more information.
Chrome Enterprise Browser
You will need to perform some steps in Google Workspace to configure Chrome Enterprise browsers to send device information to Duo via the Chrome Enterprise Device Trust Connector (DTC).
If you've already set up , then you've already completed the configuration needed in Google. You can skip to the Enable the Chrome Enterprise Browser Data Source section.
Prerequisites
- A Google Enterprise Cloud Management account.
- Endpoints running macOS, Windows, or Chrome OS.
- ChromeOS devices must be enrolled in your Google Workspace domain for enterprise management.
- Chrome browsers on macOS and Windows must be enrolled in Chrome Browser Cloud Management.
Requirements
- The protected applications must have the Duo Universal Prompt enabled.
- Access to the Duo Admin Panel as an administrator with the Owner, Administrator, or Application Manager administrative roles.
- Chrome DTC does not work for Duo Passwordless authentications.
- Chrome DTC does not support thick-client apps, such as Outlook. Users will be blocked from authentication from thick-client apps if Chrome Enterprise browser is the only device data source and you require a health check. Use Duo Desktop as your health data source instead.
- Linux is not currently supported for health check policy using Chrome Enterprise as the device data source.
Configure Chrome Enterprise Browser as a Device Data Source
-
Log in to the Google Workspace Admin console as an administrator and navigate to Chrome browser → Connectors.
-
Click NEW PROVIDER CONFIGURATION, locate Cisco in the provider list, and click SET UP underneath it.
-
Give your new Cisco configuration any meaningful and unique Configuration name you wish.
-
Copy and paste the following information into the new provider configuration:
URL patterns to follow
https://duosecurity.comService accounts
duo-chrome-dtc@duo-verified-access.iam.gserviceaccount.comChanging the enforcement level is not required.
-
Click ADD CONFIGURATION to save.
-
Navigate to Chrome Browsers → Connectors again if necessary.
-
In "Device Trust Connectors", find and apply the new provider configuration.
-
Click Save.
Enable the Chrome Enterprise Browser Data Source
-
Log in to the Duo Admin Panel and navigate to Devices → Device Data Sources.
-
Click Configure under "Chrome Enterprise browser".
-
Toggle on the "Enable Chrome Enterprise browser as a device data source" control at the bottom of the "Chrome Enterprise Browser" page.
Configure Device Health Checks in Policy
Apply a policy with device health checks enabled which can use your configured device data sources.
See the Duo Desktop health check policy documentation to learn more.
Verify your Setup
With the Chrome Enterprise browser data source enabled and device health check options configured in policy which can use Chrome Enterprise device data, Duo will collect and evaluate device health data from Chrome Enterprise when users log into applications which feature the Duo Universal Prompt with an enrolled Chrome browser.
Authenticate to a protected Universal Prompt application using an enrolled Chromebook or an enterprise-managed Chrome browser on macOS or Windows to verify.
Learn more about Google Chrome Enterprise device trust connectors.