Cisco Duo pricing and MFA licensing tiers. What each edition costs and who needs it.

Duo costs $3, $6 or $9 per user per month at list, but the bill depends as much on how many users sit in your account as on the edition. Fix both before you negotiate the rate.

Cisco Duo lists four editions: Duo Free for up to 10 users, then Essentials at $3, Advantage at $6 and Premier at $9 per user per month. Your bill is the edition price multiplied by the number of users in your Duo account. Both numbers are negotiable, and in most Duo renewals we review, Cisco's opening quote overstates both.

This guide draws on more than 50 Cisco engagements at our Cisco advisory practice, checked against the Cisco Duo editions and pricing page and the Cisco Duo MFA product page. For the wider Cisco renewal, read our Cisco ELA guide for 2026 and the Cisco ELA true up guide.

How much does Cisco Duo cost per user in 2026?

At list, Duo costs $0 for up to 10 users on Duo Free, $3 per user per month on Essentials, $6 on Advantage and $9 on Premier. Advantage costs twice what Essentials does, and Premier three times. These prices have been unchanged since at least April 2023.

The published rates are the price for 1 to 999 users. Cisco's Duo ordering guide, updated July 7, 2026, lists lower volume bands, so a large buyer should never negotiate down from $6.

What does each Duo tier actually deliver?

• Essentials. MFA across web and on premises applications, Duo single sign on, passwordless login and Trusted Endpoints, which tells managed devices apart from unmanaged ones. This covers most office workers.
• Advantage. Adds risk based authentication, Device Health checks on operating system, patch level, encryption and firewall, Duo Passport to cut repeat logins, session theft protection and identity threat detection. It suits regulated functions and contractor heavy populations.
• Premier. Adds Remote Access, which runs through the Duo Network Gateway and gives VPN less access to internal web applications and SSH servers, plus Security Agent Verification. It belongs with zero trust and VPN replacement programs.

Two features are often placed in the wrong tier during a sales cycle. Trusted Endpoints already comes with Essentials, and the Duo Network Gateway needs Premier, not Advantage. Check both against the edition table before you accept an upgrade argument that relies on them.

Which ordering rules shape the price?

• Term. Subscriptions run 12 to 60 months, billed annually or prepaid for the full term.
• Auto renewal. Orders renew automatically by default. You can switch that off without making the deal nonstandard, and a renewal can be cancelled up to 60 days before the new term starts.
• No midterm credit. Cisco does not allow midterm cancellations for credit, so an oversized order stays paid for until the term ends.
• One edition per subscription. Each Duo account carries one subscription with one edition, and sub accounts must match the parent edition.
• Telephony credits. Each user gets 100 telephony credits a year for SMS and phone call authentication. Extra credits cost $15 per 1,000.
• Self service increments. Below 100 users, licenses come in blocks of 10. Above 100, blocks of 25.

Duo is also available inside the Cisco Enterprise Agreement (EA 3.0) with the same editions. Our Umbrella, Duo and XDR licensing guide covers how Duo fits alongside the rest of the Cisco security portfolio. If Duo renews in the same cycle as Webex, read our guide to Cisco collaboration suite licensing as well.

What have we seen in recent Cisco Duo renewals?

In 2024 and 2025 we benchmarked 40 to 50 Cisco Duo renewals, roughly 45 in all. In 8 of every 10, Cisco's opening quote moved the entire user base to Advantage. Three patterns recurred.

• Advantage controls were underused. Risk based policy and the other controls that separate Advantage from Essentials were used by 20 to 35 percent of the licensed population, not the full base.
• User counts crept up. Because Duo counts every user in the account, the renewal count ran 12 to 22 percent above the prior contract baseline.
• Standalone beat the bundle. Standalone Duo settled 30 to 45 percent below the bundled Security Cloud subscription on three year terms when the customer documented that it did not use Umbrella and Talos.

Enterprise discounts typically ran 20 to 35 percent off list on three year terms. After tier rationalization and a tighter user count, the median run rate reduction was 22 percent.

How does Duo count users for billing?

Duo bills every user in your Duo account, whether or not that person authenticated during the term. Disabled users and users who never enrolled count too. If a username exists in Duo, it consumes a license until it is deleted.

You will sometimes see Duo billing described as a count of users with one authentication in the billing month. That is not how Duo bills. Neither the Cisco end user license agreement nor the Duo ordering rules offer an activity based count, so any such definition has to be written into your order as a negotiated term.

Why fix the user count before the rate?

A discount applies to whatever count Cisco bills, so a bloated count erodes every point you win on price. Moving from the full account count to the five authentication threshold typically removes 12 to 22 percent of the billed population. Settle the definition first, then negotiate the rate card.

Cisco rarely raises alternative definitions during a quote cycle, and it resists them. Where it refuses, you can still get much of the benefit by cleaning the account before the count is taken, which needs no contract change.

How do you check your own Duo user count?

• Users page in the Duo Admin Panel. Click the Inactive count, which lists users with no authentication in the past 30 days, and the Not Enrolled count. Check the status column for disabled users, then export the filtered list as CSV.
• Inactive User Expiration. In Global Settings, send users to the trash after a set number of days without activity, up to 365. Trashed users are deleted after 1 to 30 days, 7 by default.
• Directory sync scope. Check which Active Directory or Entra ID groups feed Duo. A sync scoped to "all staff" often pulls in service accounts, leavers and mailbox only users.
• Authentication log. Export the log from the Admin Panel or pull it through the Admin API, then count authentications per user per month to see who falls below five.

Can you put different Duo editions on different user groups?

Not inside a single subscription. Cisco's ordering rules allow one edition per Duo subscription and require sub accounts to match the parent edition. A tiered design therefore means separate Duo accounts, each with its own subscription, admin panel and policy set, and a quote structure you agree with the account team up front.

That overhead is usually worth carrying. Blanket Advantage is Cisco's preferred renewal pattern, and in our renewals mapping each segment to its own tier typically improved the run rate by 15 to 25 percent against that blanket rollout.

What discipline does the tiered model demand?

The model holds only if you can show where each segment boundary sits when Cisco asks. Tie each tier to a directory group, role or organizational unit, and have directory sync place users in the right account. Review the mapping at every quarterly review, because transfers and new hires break it quickly.

Should you license everyone at Advantage and switch features on later?

This is the standard partner pitch at a Duo renewal: put the whole base on Advantage so risk based authentication and device controls are ready when security wants them. We advise against it. In roughly 40 of the 45 renewals we benchmarked, fewer than 35 percent of users ever used the Advantage controls.

The uplift paid for nothing a targeted Advantage account could not have delivered. Keep Essentials as the default, put regulated and admin segments on Advantage or Premier, and fix the rates for a three year term. If more groups need Advantage later, add them through the substitution right described below.

What does tier rationalization save on a 32,000 user renewal?

On a hypothetical 32,000 user account, moving 20,000 standard users from Advantage to Essentials cuts the list cost by $600,000 a year. Cleaning 3,000 stale accounts from the Essentials population takes off another $90,000. All figures use the 10,000 to 99,999 volume band at list, before any discount.

The list model shows a $690,000 reduction, or 36 percent, and you should treat that as a ceiling. The discount on the blanket quote, an Advantage segment that grows once security reviews the design, and the cost of running two accounts all pull it down. The renewals we benchmarked landed well below it, at the 22 percent median noted above.

Check how the quote bands each account. Cisco sets the band by the number of licenses purchased, and here both accounts stay in the 10,000 to 99,999 band. A split that leaves one account under 10,000 users puts it in the 1,000 to 9,999 band, at $2.84 for Essentials or $5.67 for Advantage, and trims the saving.

How does this change for a 500 user buyer?

At 500 users a second Duo account rarely pays for its administration, so you choose one edition for everyone. Essentials at $3 costs $18,000 a year at list, and Advantage at $6 costs $36,000. Buy Advantage only if Device Health or risk based policy has a firm deployment date this term.

Duo bills the users sitting in the account, so clean the account before Cisco counts it.

When does the Security Cloud bundle beat standalone Duo?

The bundle wins only when you already run most of what it contains. Cisco positions Duo inside the Cisco Security Cloud platform alongside Umbrella DNS security, Talos threat intelligence and other Cisco security services. In a quote, that usually arrives as the User Protection Suite.

• User Protection Suite Essentials. Cisco Secure Access Essentials, Duo Advantage and Email Threat Defense.
• User Protection Suite Advanced. Secure Access Advantage in place of Essentials, plus Secure Endpoint Advantage, ISE 3.x Premier, Duo Advantage and Email Threat Defense.

Customers who bought the suite before December 4, 2024 keep Duo Premier. The suite is priced per covered user, meaning anyone protected by any of the included services, so you pay the full suite rate even for users that some of the services never protect.

When is the bundle the right answer?

1. You already deploy Umbrella and use Talos threat intelligence. If those services run today, one subscription typically costs less than three separate SKUs.
2. Your network edge is already Cisco. With Meraki or Catalyst in place, the Security Cloud bundle fits your existing operations more cleanly.
3. You plan for three years or more. Bundle pricing improves with a multiyear term and a fixed rate card.

If you do not run the full Security Cloud stack, standalone Duo is usually the cheaper contract. Document which bundled services you do not use, and price standalone Duo against the suite before you accept either.

What will the Cisco account team say, and how should you answer?

• "Advantage is our most popular edition, so most customers standardize on it." What other customers buy tells you nothing about your policies. Ask them to name the Advantage controls your policies use today and the percentage of users they apply to.
• "You need Advantage for Trusted Endpoints." Trusted Endpoints is included in Essentials on Cisco's own edition table. Ask for the claim in writing or drop it from the business case.
• "Every user in the account is billable under the terms." That is the standard position. Reply with the account cleanup you will complete before the count date, and ask for a five authentication threshold or a population lock as a written term.
• "The suite gives you Duo almost for free." Ask for the suite price with and without Secure Access and Email Threat Defense, and compare it with standalone Duo at your volume band.

Which contract clauses matter on a Duo renewal?

Five clauses matter more than the headline discount. Work through them as a checklist during redlines.

• User definition. Fix the count at the five authentication threshold, or an equivalent, for the whole term.
• Contractor and seasonal carve out. Make it time bound and defined by a named identity attribute.
• Tier substitution rights. Let users move between editions, and between your Duo accounts, without repapering the contract.
• Price protection. Hold per user prices for the whole term with no annual reset, and cap the uplift at renewal.
• Cancellation terms. Get prorated relief on the contractor and seasonal carve out, since Cisco's standard terms give no credit for midterm cancellation.

Also set auto renewal to off on the order. That keeps the 60 day cancellation window from closing on a renewal you have not reviewed.

What redlines fail most often?

Tier substitution rights and a fixed user definition are the two clauses Cisco resists hardest. Offer visibility of your deployment plan in return, such as a quarterly usage report shared with Cisco. Both sides get predictability, and you keep the option to rebalance editions.

What should the renewal timeline look like?

What to do next

1. Check the current edition against use. Find how many users sit on Advantage or Premier without using any control above Essentials.
2. Clean the account. Turn on Inactive User Expiration, remove disabled users and narrow directory sync before Cisco takes the count.
3. Design the tiered accounts. Map each user segment to an edition and decide whether the saving justifies a second Duo account.
4. Change the user definition. Ask for the five authentication threshold or a population lock in place of the full account count.
5. Price Duo outside the bundle. Compare standalone Duo with the User Protection Suite at your volume band before accepting either.
6. Fix per user pricing for the term. Prefer three years, avoid annual reset language and switch auto renewal off.
7. Negotiate the contractor and seasonal carve out. Variable populations need it to avoid true up exposure.
8. Get independent support. Contact our Cisco advisory practice to scope the renewal. We work for buyers only, on a fixed fee.

Frequently asked questions