UserLock: A Duo MFA Alternative | IS Decisions

UserLock: A Duo MFA Alternative

This article was originally published by LOGON’s partner IS Decisions. Click here to view the original article.

Here we look closer at the two best examples of Multi-Factor Authentication Solutions in the market, specifically how they integrate with Active Directory and support hybrid on-premise/cloud environments. We’ve broken down the finer details of UserLock vs. Duo to showcase the pros and cons of each and give you a clearer idea of which may work best for your organization.

Duo MFA review

Duo, sometimes called Duo Security, is part of the Cisco Secure Suite of security products, and its Duo MFA edition offers MFA and 2FA. MFA users frequently choose the Duo Push mobile app as the second authentication method but can also choose other authentication methods. Examples of these methods include biometrics, security keys, tokens, securely generated passcodes, and additional verification codes for the Duo Push mobile application.

DUO – Pro

It’s supported across a wealth of major devices, including iOS, Android, Windows, and more.

The user interface is simple, easy to use and the end-user portal is also easy to access for admins and end-users.

There’s a variety of authentication methods available.

It allows IT admins to choose between an admin enrolling users or user self-enrollment.

Remote access and platform management can help identify threats and increase security for a business’s systems and networks.

Endpoint analysis for devices allows Duo to manage and monitor users authenticating with whatever device they use.

Organizations that have already transitioned to 100% cloud-based identity management will most benefit from Duo’s cloud-oriented features and functionalities.

Before you choose to implement Duo, you can use the free 30-day trial to test it and help truly determine if it’s the right option for you.

DUO – Cons

The on-premise integrations and capabilities are more of an add-on than by design.

User profiles have to be created in Duo, either manually or through the synchronization.

IT admins with an Active Directory environment must manage an additional, duplicate directory since identity authentication takes place in the cloud, which complicates management and can be time-consuming.

As authentication takes place in the cloud this also means there’s no offline MFA. This can lead to security risks through instances of unreliable connectivity to the cloud. Additionally, it can lead to compliance issues for some.

Active Directory integration is not automatic and requires installing another piece of software, Duo Authentication Proxy.

Synchronization is needed as Duo acts as the identity provider which can be a problematic process.

Synchronization with Active Directory only runs twice a day automatically (manual synchronization is possible), which can lead to a loss of time and incomplete visibility.

Since many compliance regulations require identity authentication to remain on-premise, Duo cannot fulfill many organizations’ security requirements.

Such cloud systems also often lack the tools and features to manage the on premise infrastructure organizations will need to retain to support legacy systems.

Session control beyond MFA is not possible.

An absence of granular MFA means that local and RDP settings are minimal, and admins can’t choose to prompt MFA for certain users or groups for remote or local connections.

A wide variety of authentication methods can be confusing and complicated.

The user interface can be quite cluttered in places, and some users think the portal gives too many options (particularly IT admins).

The pricing structure makes the cost very expensive for both smaller and very large numbers of users, which can be prohibitive for SMBs and enterprises alike.

Additional IT support would be useful for those on lower-cost plans.

Administrators can only configure offline MFA (without an internet connection) as a temporary solution for a set number of connections or days.

Duo MFA alternative: UserLock

Our Duo MFA alternative, UserLock, secures on-site, cloud, and remote access with MFA and SSO capabilities. In addition to this, your organization can pair MFA with powerful contextual restrictions and session management capabilities, adding even more layers of security to verify further all users’ claimed identity and secure network access.

With UserLock’s contextual restrictions, your IT admins can set policies to authorize, limit or deny access attempts by machine, device, location, time, session type, initial access point, and several simultaneous sessions.

And IT admins can also customize MFA conditions to ensure less friction for users. UserLock’s granular MFA allows organizations to customize, set and manage UserLock MFA by aspects like user, group, organizational unit (OU), and connection type. Critically, this means the IT admin doesn’t have to require MFA each time a user logs in. The IT admin defines what circumstances require MFA, allowing organizations to balance user productivity and security.

UserLock VS. Duo comparison: Active Directory compatibility

Last but certainly not least, an essential user requirement regarding UserLock vs. Duo is their AD compatibility. Both platforms can be integrated with AD and considered secure, but there’s a significant and notable difference here.

UserLock builds on AD and keeps AD as the identity platform. Therefore, UserLock can apply changes to the access control rules of users in almost real-time.

UserLock’s seamless extension on AD allows administrators to see and react to help prevent threats in real time. For example, suppose a user in your company asks to work outside their existing access control rule (i.e., during unauthorized hours). In that case, the IT admin can apply a new temporary law that will automatically revert to normal.

By comparison, Duo MFA’s Active Directory synchronization runs twice daily, or an admin manually does it. This process isn’t as efficient or reactive as UserLock and won’t be as practical, and it may also take additional time to manage.

As such, with UserLock, your organization essentially retains the use and functionality of your chosen AD so that you encounter much less disruption with your overall processes.

With all the above, you should be better positioned to select a platform that suits your organization’s AD and specific requirements. If you’re considering UserLock, schedule a demo to try it out today.

User Logon Security for Windows Active Directory

Enable customized, two-factor authentication (2FA) on Windows logon, Remote Desktop (RDP & RD Gateway), IIS, VPN and Cloud Applications. Apply customized login restrictions by user, group or organizational unit (OU).

Solution Highlight

Get started with UserLock

Start a free trial with UserLock, with 30-day full version, no user limit, and free technical support.

Start Your Free Trial

Blog, ISDecision Blog, UserLock