Cisco Duo. The MFA licensing framework.

Cisco Duo is the dominant enterprise multi factor authentication platform. The 2026 pricing cycle widened the gap between tiers and tightened the active user definition. This guide is the buyer side framework that anchors the right tier to the right user population.

Duo is priced per user per month across four tiers. The publisher's preferred renewal pattern defaults the entire user base to Duo Advantage, which doubles the per user cost compared with Duo Essentials. The buyer side framework matches the right tier to the right user population.

This guide draws on more than fifty Cisco engagements at our Cisco advisory practice. Read the related Cisco ELA guide for 2026 and the Cisco ELA true up guide.

The four Duo tiers

Duo runs four commercial tiers. The Free tier covers up to ten users and is positioned for pilots. The three commercial tiers are Essentials, Advantage, and Premier.

What each tier actually delivers

• Essentials. MFA across web applications, native SSO, and basic device health. Covers most knowledge worker populations.
• Advantage. Adds risk based policy, trusted endpoints, and the Duo Network Gateway. Useful for regulated functions.
• Premier. Adds Duo Passport for VPN-less remote access and the privileged access management framework. Tied to zero trust programs.

The active user definition

Duo bills on the active user count, not the licensed user count. The active user definition is the single largest cost lever on the contract.

The tiered population framework

The buyer side framework maps each user segment to the appropriate Duo tier. The framework typically delivers 15 to 25 percent run rate improvement against the publisher's preferred blanket Advantage rollout.

“Cisco quoted us Advantage at six dollars per user across thirty two thousand users. We moved the bottom twenty thousand to Essentials and re-defined active users at the five auth threshold. Annual save: four hundred forty thousand.

The Security Cloud bundling pattern

Cisco progressively pushes Duo into the broader Cisco Security Cloud subscription. The bundle includes Umbrella DNS security, Talos threat intelligence, and other Cisco security services.

When the bundle is the right answer

1. Active deployment of Umbrella and Talos. If the customer already deploys the bundled services, the unified subscription typically delivers better economics.
2. Cisco network footprint at the edge. If the Cisco footprint includes Meraki or Catalyst at the edge, the Security Cloud bundle integrates more cleanly.
3. Three plus year horizon. The bundle economics improve materially with the multi year term.

For customers that do not deploy the full Security Cloud stack, the standalone Duo subscription is typically the better commercial framework. Validate the deployment readiness before accepting the bundle.

Contract clauses that matter

• Active user definition. Locked at the five authentication threshold or equivalent.
• Contractor and seasonal carve out. Time bound, defined population.
• Tier substitution rights. Move users between tiers without re papering the contract.
• Price protection. Per user pricing locked across the term.
• Cancellation framework. Pro rated relief on the contractor and seasonal carve out.

What to do next

1. Audit the current Duo tier across the user base. Identify how many users are licensed at Advantage or Premier without deploying the upper tier controls.
2. Build the tiered population framework. Map user segments to the right tier rather than accepting blanket coverage.
3. Re-define active users. Move from the one authentication definition to the five authentication threshold.
4. Unbundle Duo from the Security Cloud package. Validate that the Cisco Security Cloud bundle delivers more than the standalone Duo subscription.
5. Lock the per user pricing across the term. Three year terms preferred. Avoid the annual reset language.
6. Negotiate the contractor and seasonal carve out. Variable populations need the carve out to prevent true up exposure.
7. Engage independent buyer side support. Contact our Cisco advisory practice for the renewal scoping.

Frequently asked questions

What is the typical price per user across the Duo tiers?

Duo Essentials runs about three dollars per user per month at list. Advantage doubles to six dollars. Premier moves to nine dollars. Enterprise volume discounts typically run 20 to 35 percent off list on three year terms.

Should we move from Essentials to Advantage for the whole estate?

Only if you actively deploy risk based authentication and trusted endpoints on the entire user base. Most enterprises deploy those controls on 20 to 40 percent of users. The tiered population framework typically delivers a better outcome than the blanket upgrade.

How is active user pricing calculated?

The Cisco preferred definition counts any user with one authentication in the billing month. The buyer side preferred definition uses the five authentication threshold, which excludes seasonal, contractor, and intermittent users from the billing baseline.

Is Duo bundled into Cisco Security Cloud?

Yes. Cisco pushes Duo into the broader Security Cloud subscription that also includes Umbrella, Talos threat intelligence, and other Cisco security services. Standalone Duo remains available and is typically the better commercial framework for customers that do not deploy the full Security Cloud stack.

What is the typical save on the Duo renewal?

Fifteen to twenty five percent run rate improvement after the tier rationalization, the active user definition tightening, and the contractor carve out. The save depends on the current overbuy and the credibility of the alternative MFA scenario.

The framework is set out in the Cisco advisory practice. Read the related Cisco ELA guide and the Cisco collaboration suite licensing.