Skip navigation
Documentation

Duo Trusted Endpoints - Google Verified Access for Chromebooks

Last Updated: October 5th, 2021

Duo's Trusted Endpoints feature secures your sensitive applications by ensuring that only known devices can access Duo protected services. When a user authenticates via the Duo Prompt, we'll check for the access device's management status. You can monitor access to your applications from managed and unmanaged devices, and optionally block access from devices not managed by your organization.

Trusted Endpoints for Google Verified Chromebooks is in Public Preview. Please contact us if you have any issues or feedback.

Trusted Endpoints is part of the Duo Beyond plan.

Overview

Google's Verified Access is hardware-backed method of device identity and status confirmation. When a user authenticates via the Duo Prompt using a Chromebook, Google Verified Access attests that the Chromebook is enrolled in enterprise device management and is thus compliant with all enterprise policies.

Prerequisites

Create the Google Verified Access for Chromebooks Integration

  1. Log in to the Duo Admin Panel and navigate to Trusted Endpoints.
  2. If this is your first management integration, click the Configure Management Tools Integration button at the bottom of the page. If you're adding another management integration, click the Add Integration button you see instead.
  3. On the "Add Management Tools Integration" page, locate Google Verified Access for Chromebooks in the listed integrations and click the Add this integration selector.
  4. Choose Chrome OS from the "Recommended" options, and then click the Add button.

The new Google Verified Access for Chromebooks integration is created in the "Disabled" state. You'll turn it on when you're ready to apply your Duo trusted endpoints policy.

Keep the Duo Admin Panel open in your browser. You'll need to refer back to the Google Verified Access management integration page to complete the G Suite configuration steps.

Configure Duo Verified Access in G Suite

Turn on Verified Access

  1. Log on to the G Suite Admin console as an administrator and navigate to Devices, and then use the left-side navigation to go to ChromeSettingsDevice.

  2. In the "Enrollment & Access" section, locate the "Verified Access" setting and select Enable for Content Protection.

  3. Change the "Verified Mode" setting to Require verified mode boot for verified access.

  4. Copy the account string duo-verified-access@duo-verified-access.iam.gserviceaccount.com from the Admin Panel and paste it in "Services with Full Access" box (described as "Service accounts which are allowed to receive device ID").

  5. Click Save.

Deploy the Duo Verified Access Extension

  1. While still logged in to the G Suite Admin console as an administrator, navigate to DevicesChromeApps & extensionsUsers & browsers.

  2. On the "Users & browsers" tab, click the plus sign in the lower right and select "Add from Chrome Web Store" (the icon that displays the Chrome browser logo).

  3. Search the Chrome Web Store extensions for Google Verified Access by Duo. Click it to view the extension details, and click Select on the "Google Verified Access by Duo" details page.

  4. Change the "Installation Policy" for the "Google Verified Access by Duo" extension to Force install.

  5. Click on the "Google Verified Access by Duo" extension to open its settings. Enable the Allow enterprise challenge setting in the "Certificate Management" section.

  6. Click SAVE at the top of the page.

Add G Suite Domains to Duo

  1. Return to your Google Verified Access for Chromebooks management integration page in the Duo Admin Panel.

  2. Enter a comma separated list of your G Suite domains in the "Enter G Suite Domains" box and click Save. Most organizations will only need to specify one G Suite domain.

At this point the configured integration is disabled and applies to no users until you finish your deployment.

Finish Trusted Endpoints Deployment

After creating the Duo Mobile management integration, set the Trusted Endpoints policy to start checking for Chromebook enrollment as users authenticate to Duo-protected services and applications.

When your trusted endpoints policy is applied to your Duo applications, return to the Google Verified Access trusted endpoint management integration in the Admin Panel. The "Change Integration Status" section of the page shows the current integration status (disabled by default after creation). You can choose to either activate this management integration only for members of a specified test group or groups, or activate for all users.

Enable Trusted Endpoints Management Integration

The Device Insight and Endpoints pages in the Duo Admin Panel show which access devices are trusted/managed and enrolled in Duo Mobile.

Verify Your Setup

Authenticate to a protected application using an enrolled Chromebook.

When the trusted endpoints policy is set to just check access devices, users receive access to the application (assuming the Chromebook passes all other policy verification), and Duo records the trusted or untrusted status of that device.

If the trusted endpoints policy blocks access from unmanaged devices and Duo successfully verifies the Chromebook's management status and configuration against the required policy settings then the user receives access to the protected application.

If the Chromebook fails the configuration and policy checks then Duo denies application access.

Troubleshooting

Need some help? Take a look at our Trusted Endpoints Knowledge Base articles or Community discussions. For further assistance, contact Support.