Cisco Duo. The MFA licensing framework.

Cisco Duo runs four MFA tiers and a per user pricing model. The 2025 to 2026 cycle widened the gap between Essentials and Advantage and tightened the active user definition. This is the buyer side framework that anchors the right tier to the right user population.

Duo is priced per user per month across four tiers. The publisher preferred renewal pattern defaults the entire user base to Advantage, which doubles the per user cost compared with Essentials. The buyer side framework matches the right tier to the right user population.

This guide draws on more than fifty Cisco engagements at our Cisco advisory practice. Tier definitions and list pricing are documented on the Cisco Duo editions and pricing page. The MFA control set is anchored on the Cisco Duo MFA product page.

Read the related Cisco ELA guide for 2026 and the Cisco ELA true up guide for the broader Cisco renewal context.

How does Cisco Duo split its four MFA licensing tiers?

Duo runs four commercial tiers. Free covers up to ten users and is positioned for pilots. The three commercial tiers are Essentials, Advantage, and Premier. The list rates below are published by Cisco and are the anchor for any renewal negotiation.

What does each Duo tier actually deliver?

• Essentials. MFA across web applications, native single sign on, and basic device health. Covers most knowledge worker populations.
• Advantage. Adds risk based policy, trusted endpoints, and the Duo Network Gateway. Useful for regulated functions and contractor heavy estates.
• Premier. Adds Duo Passport for VPN less remote access and privileged session controls. Tied to zero trust programs.

How does the active user definition drive the Duo bill?

Duo bills on the active user count, not the licensed user count. The active user definition is the single largest cost lever on the contract. The publisher preferred definition is documented inside the Cisco product terms; the alternative definitions sit inside the standard Cisco end user license agreement and are available on request.

Why is the metric the lever?

The publisher rarely volunteers the alternative definitions during a quote cycle. They are available in every standard Cisco Duo master subscription agreement and can be redefined at renewal. Tighten the metric first, then negotiate the rate card.

How should buyers map user populations to the right Duo tier?

The buyer side framework maps each user segment to the appropriate tier rather than defaulting the full base to Advantage. The framework typically delivers a 15 to 25 percent run rate improvement against the publisher preferred blanket Advantage rollout.

What discipline does the tiered framework demand?

The tiered model only holds if the customer can defend the segment boundaries during an audit. Maintain a documented mapping of each tier to a user identity attribute (group, role, or organizational unit) and refresh it at every quarterly review.

Where the common advice on Cisco Duo tier upgrades is wrong

The standard partner pitch on the Duo renewal is to default the full base to Advantage so the customer can light up risk based authentication and trusted endpoints later. We disagree. Across roughly 40 of the 45 Duo renewals we benchmarked between 2024 and 2025, fewer than 35 percent of users ever exercised the Advantage controls, and the partner uplift on the blanket upgrade financed nothing the customer could not have unlocked through a targeted Advantage carve. The buyer side move is to keep Essentials at the population level, carve Advantage to regulated and admin segments, lock the rate card across a three year term, and protect optionality at every renewal step.

45

Cisco Duo renewals benchmarked

35%

Users exercising Advantage controls

22%

Median run rate reduction

Source: Redress Compliance advisory engagement file, 2024 to 2025.

“Cisco quoted us Advantage at six dollars per user across thirty two thousand users. We moved the bottom twenty thousand to Essentials and redefined active users at the five authentication threshold. Annual save: four hundred forty thousand.

When does the Security Cloud bundle deliver better economics?

Cisco progressively pushes Duo into the broader Cisco Security Cloud subscription. The bundle includes Umbrella DNS security, Talos threat intelligence, and other Cisco security services.

When is the bundle the right answer?

1. Active deployment of Umbrella and Talos. If the customer already deploys the bundled services, the unified subscription typically delivers better economics than three separate skus.
2. Cisco network footprint at the edge. If the Cisco footprint already includes Meraki or Catalyst, the Security Cloud bundle integrates more cleanly into the existing operational model.
3. Three or more year horizon. Bundle economics improve materially with the multi year term and the locked rate card.

For customers that do not deploy the full Security Cloud stack, standalone Duo is typically the better commercial framework. Validate deployment readiness before accepting the bundle.

Which contract clauses matter on a Duo renewal?

Five clauses carry more leverage than the headline discount. Treat them as a checklist on the redline cycle.

• Active user definition. Locked at the five authentication threshold or equivalent throughout the term.
• Contractor and seasonal carve out. Time bound and defined by a named identity attribute.
• Tier substitution rights. Move users between tiers without repapering the contract.
• Price protection. Per user pricing locked across the term, not subject to annual reset.
• Cancellation framework. Pro rated relief on the contractor and seasonal carve out.

What redlines fail most often?

Tier substitution rights and the locked active user definition are the two clauses Cisco resists hardest. Trade visibility on the deployment plan (a quarterly utilization report shared back to Cisco) for the clause. Both sides win predictability; the customer keeps optionality.

What to do next

1. Audit the current Duo tier across the user base. Identify how many users are licensed at Advantage or Premier without exercising the upper tier controls.
2. Build the tiered population framework. Map user segments to the appropriate tier rather than accepting blanket coverage.
3. Redefine active users. Move from the one authentication definition to the five authentication threshold.
4. Unbundle Duo from the Security Cloud package. Validate that the bundle delivers more than the standalone subscription.
5. Lock per user pricing across the term. Three year terms preferred. Avoid annual reset language.
6. Negotiate the contractor and seasonal carve out. Variable populations need the carve out to prevent true up exposure.
7. Engage independent buyer side support. Contact our Cisco advisory practice for renewal scoping.

Frequently asked questions

What is the typical price per user across the Duo tiers?

Duo Essentials runs about three dollars per user per month at list. Advantage doubles to six dollars. Premier moves to nine dollars. Enterprise volume discounts typically run 20 to 35 percent off list on three year terms.

Should we move from Essentials to Advantage for the whole estate?

Only if you actively deploy risk based authentication and trusted endpoints on the entire user base. Most enterprises deploy those controls on 20 to 40 percent of users. The tiered population framework typically delivers a better outcome than the blanket upgrade.

How is active user pricing calculated?

The Cisco preferred definition counts any user with one authentication in the billing month. The buyer side preferred definition uses the five authentication threshold, which excludes seasonal, contractor, and intermittent users from the billing baseline.

Is Duo bundled into Cisco Security Cloud?

Yes. Cisco pushes Duo into the broader Security Cloud subscription that also includes Umbrella, Talos threat intelligence, and other Cisco security services. Standalone Duo remains available and is typically the better commercial framework for customers that do not deploy the full Security Cloud stack.

What is the typical save on the Duo renewal?

Fifteen to twenty five percent run rate improvement after the tier rationalization, the active user definition tightening, and the contractor carve out. The save depends on the current overbuy and the credibility of the alternative MFA scenario.

How long should a Duo renewal cycle take from kickoff to signature?

Plan for ninety to one hundred and twenty days. The first thirty days are the user population audit and the active user metric trace. The next thirty days are the carve out modelling and the rate card benchmarking. The final thirty days are redlines and signature. Compressed cycles concede the active user definition.

The framework is set out in the Cisco advisory practice. Read the related Cisco ELA guide and the Cisco collaboration suite licensing.