Duo secures the login. Authnull secures everything behind it.
Duo is excellent MFA for cloud apps and the perimeter. But the access paths that fail your audit — Active Directory, Windows and Linux logon, RADIUS, network gear — sit below that line. Duo reaches them as a set of separately-licensed components. Authnull covers them as one enforcement layer, at one price.
Already running Duo? Keep it. This page is about the gap it leaves below the cloud login — and how to close it without a rip-and-replace.
We're not going to pretend Duo is a bad product. It isn't.
If your problem is multi-factor for cloud applications and a clean end-user experience, Duo is one of the best choices on the market. Here's what it does well — and we mean it.
So why do teams still call us? Because the finding on their audit isn't about cloud apps. It's about the domain controller, the jump host, the firewall, and the Linux fleet — the surfaces underneath the IdP. That's a different shape of problem, and it's where the architecture starts to matter.
Same paths, two shapes: a patchwork of components, or one enforcement layer.
Duo can reach Active Directory, RDP, and VPN — through a separate add-on for each, installed and licensed on its own, several gated to higher editions. Authnull treats every one of those paths as the same enforcement decision, from a single policy plane.
How each one actually covers the gap.
Not a checkmark contest. Where Duo covers a path, we say so — and say how, because the “how” is the cost and the operational load.
Cloud SSO is Duo's home turf — Authnull co-exists there rather than competing. The rows that move an audit are the ones below it.
Do the math with your own numbers.
The catch isn't the sticker price of Duo's entry tier — it's that the on-prem coverage you're here for lives in the higher editions, licensed across every user. Set your headcount and the tier that actually covers your gap.
Duo figures use publicly published list prices ($3 / $6 / $9 per user / month, Essentials / Advantage / Premier). Authnull flat rates as of June 2026. Confirm against your quote.
Coexist → Consolidate → Replace (at your pace)
No forced cutover. The path looks different for every team.
Coexist
Keep Duo exactly as-is on cloud apps. Drop Authnull onto the unprotected paths — AD logon, RDP, RADIUS, firewalls, Linux. Nothing you rely on changes.
Consolidate
Move overlapping paths — RDP, VPN — onto one policy plane. Retire the Duo components you were self-hosting and drop down a Duo edition you no longer need.
Replace (optional)
When you're ready, Authnull co-exists on cloud SSO too — so you can retire Duo entirely, or keep it for the device-trust features you like. Your call, not a forced cutover.
Bring your Duo setup. We'll show you exactly what's still uncovered.
Twenty minutes, your real environment, no slides. Or start free and enforce MFA on AD, RADIUS, Windows, and Linux this week.