Cisco Duo vs privacyIDEA: when each choice fits
Duo fits teams that want a managed cloud service with push and device trust, while privacyIDEA fits teams that must keep authentication on premises. The decision usually surfaces at a Duo renewal, when a data residency rule is applied to login traffic, or when a network is isolated and cannot reach a vendor cloud at all. Those triggers tend to arrive with a deadline, so it helps to settle the three questions below before the contract conversation starts rather than after it. The first question is where authentication traffic may travel. Duo's Authentication Proxy and its push flow depend on outbound access to Duo's cloud on port 443, so a site that forbids that path needs a different design. privacyIDEA runs inside your own network and its README describes it as keeping user data inside the operator's infrastructure. Confirm with your security team whether the rule covers only user data or also the second-factor verification requests themselves, because that answer decides whether a cloud-hosted factor is even an option. The second question is which logon paths must be covered. Map every VPN, network device, SSH host and Windows logon or RDP session that needs a second factor, then check each against privacyIDEA's RADIUS, PAM and Windows credential provider integrations. The third question is who will run enrollment, lost-token handling and support. With Duo, the vendor operates the cloud service. With privacyIDEA, your team or a partner runs the servers, the enrollment workflow and the help desk, and that work recurs for as long as the platform runs. Confirm the exact factor and integration support for your version against the privacyIDEA README before you commit.
Some requirements do not trade off cleanly. Duo's risk-based and device trust features are part of its managed service, and privacyIDEA does not offer an equivalent risk engine, so teams that depend on adaptive policies should plan compensating controls or accept the gap in writing. Push notifications with privacyIDEA require its own authenticator app, while standard TOTP and HOTP users can keep apps such as Google Authenticator, which changes how much re-enrollment a migration causes. Hardware token seeds can be imported in several formats, but that import is a one-time task that needs its own key handling and audit trail. For most sites, the practical test is a short pilot. Pick one VPN concentrator and one Windows server group, enroll a small set of users with the factors you intend to allow, and confirm what happens when the MFA service is unreachable. Record the result in the same change ticket as the renewal decision. If the pilot shows that your logon paths and enrollment load fit a self-run service, privacyIDEA is a credible fit. If it shows that you need cloud-managed risk policies across many SaaS apps, keep Duo for that scope and reserve privacyIDEA for the on-premises paths.
Which scenarios favor Duo and which favor privacyIDEA
This table matches common Duo deployment scenarios to the platform that usually fits better, and names the condition that drives the choice. Read each row against your own estate: where the deciding condition holds, the listed option is the stronger starting point. Many teams end up running both, with Duo for cloud SSO and privacyIDEA for on-premises flows.
| Scenario | Better fit | Condition that drives the choice |
|---|---|---|
| Push-based MFA for a cloud SSO estate | Cisco Duo | Users already approve sign-ins through Duo Mobile, and the SSO apps sit in the cloud where Duo's integrations are maintained by the vendor. |
| Air-gapped OT or defense networks | privacyIDEA | The MFA service must run with no outbound path to a vendor cloud, so OTP, FIDO2 and smartcard checks must be served from inside the isolated network. |
| VPN and RADIUS-heavy estates | privacyIDEA | Firewalls and VPN concentrators authenticate over RADIUS, and privacyIDEA's RADIUS integration can serve those requests on your own servers. Confirm the exact device list against your vendor documentation. |
| Windows logon and RDP | Confirm in a pilot | Both platforms offer Windows logon protection, so compare offline access, behavior when the MFA server is unreachable and support for your Windows Server versions before choosing. |
| Passkey-first policy | privacyIDEA | Policy centers on FIDO2 and WebAuthn passkeys and hardware keys, which privacyIDEA lists among its supported factors. Confirm passkey enrollment flows for your user population. |
| Sovereignty or data residency rules that bar identity data from leaving the country | privacyIDEA | User data and authentication events stay inside your infrastructure, which simplifies residency reviews. Confirm where any SMS or email gateway you add is hosted. |
| Teams without in-house identity staff | Cisco Duo | A managed cloud service removes server patching, HA design and token lifecycle work from your team. Self-hosting privacyIDEA means someone must own those tasks, so budget for that role or a support retainer. |
Where authentication data lives and who controls it
Each card answers a question that an auditor or data protection officer will ask about multi-factor authentication: where records sit, which network paths the product needs, what your team may change, and what evidence you can show. Settle these before comparing features, because they decide which deployment pattern is possible for your environment.
Data location and hosting
privacyIDEA is a self-hosted platform that keeps user data inside the operator's infrastructure, so user records, token data and authentication events stay in the systems you run. Duo's MFA is delivered as an externally hosted cloud service, which means enrollment and authentication data are held in Cisco's environment. Before you decide, ask Cisco which regions serve your tenant, which data types are stored there, and which subprocessors can access them. Then compare those answers with your residency commitments.
Outbound access on port 443
The Duo Authentication Proxy needs outbound access to Duo's cloud on port 443 to request each second factor. Every VPN gateway, network device or RADIUS and LDAP client that depends on the proxy inherits that dependency, so isolated OT, defense or lab segments cannot use it as designed. privacyIDEA's RADIUS integration can run entirely inside your network. Review your firewall rules and confirm whether any relying party sends authentication traffic through a path that reaches the internet.
AGPLv3 licensing and modification
privacyIDEA is licensed under AGPLv3, which lets your engineers read, modify and run the community code inside your organization. The AGPL also requires that modified versions offered to users over a network make their source available, so custom changes to MFA logic exposed to outside parties need legal review. The privacyIDEA Enterprise Edition from NetKnights is a separate, optional offering. Have counsel confirm how these obligations apply to internal changes, plugins and any integration you distribute to partners.
Compliance evidence and assessor scope
Assessments depend on evidence such as access logs, enrollment records, administrator changes and documented configuration. A self-hosted deployment keeps those records in systems you control, but they must be complete, retained under your own policy and protected from tampering. DeployOpen prepares systems, controls and evidence for assessments. It does not issue audit reports or certifications, which independent auditors and certification bodies provide. Ask your assessor which controls they will test before the design is fixed.
Why air-gapped and sovereignty-bound sites choose privacyIDEA
Sites with isolated OT, defense or lab networks cannot send authentication traffic to Duo's cloud, so for these environments an MFA service must run inside the perimeter. privacyIDEA is designed to keep user data inside the operator's infrastructure, which is why it is the common choice when the requirement is on-premises by design rather than by preference. The decision starts with a network question: confirm whether the segment allows any outbound path to a vendor cloud, including for licensing checks, update channels and push delivery. If it does not, a Duo deployment with its proxy is not an option, and the comparison reduces to which on-premises factors you need.
privacyIDEA serves OTP (TOTP and HOTP), FIDO2 and WebAuthn keys, and PIV or x509 smartcards, and it accepts requests over RADIUS for VPNs and network devices and over LDAP through its user ID resolvers. Verify each path against your own estate before you commit: confirm which VPN and firewall models speak RADIUS to privacyIDEA, which applications can take a smartcard login, and whether your user store is an LDAP directory that privacyIDEA can resolve. Push notifications need the privacyIDEA Authenticator app, so an air-gapped site should test that app's behavior on its managed devices, and should not assume it matches Duo Mobile.
Moving MFA on premises shifts operational duties to your team. You must run the servers, the high-availability design, backups and patching, and you must restore the service if it fails, because no vendor cloud will take over. Ask whether your change process can apply privacyIDEA releases inside the approved window, and check that backups include the token and policy database, not only the application files. The privacyIDEA installation documentation covers installation with pip and on Ubuntu and CentOS or RHEL-family systems, so confirm that your platform is one of these and that your support staff can operate it before you plan the cutover.
Licensing and editions: community project or Enterprise Edition
The community edition is the free privacyIDEA project, published under the AGPLv3 license and developed in public on GitHub. You run it on your own servers, so there is no license fee for the software itself. The cost question moves to infrastructure, staff time and any outside help you choose to buy.
- No software license fee: AGPLv3 covers use, so the budget goes to servers, high availability, staff time and any integrator you engage.
- Source-level control: You can read, patch and build from the published code, which matters when a security fix is needed before the next release.
- AGPLv3 obligations: If you modify privacyIDEA and make it available to users over a network, the license requires that those users can obtain the modified source. Have counsel confirm how this applies to your deployment.
- Community-driven support: Help comes from the project's public channels and from any partner you engage. The license itself includes no vendor-backed response commitment.
- Your own upgrade cadence: Releases such as v3.14, published October 7, 2026, arrive on the project's schedule, and you decide when to test and deploy them.
Confirm which community channels the project currently lists, and whether your security team will accept community-only response times for the system that guards VPN and logon access.
The privacyIDEA Enterprise Edition is available from NetKnights under a commercial subscription. It adds vendor support to the open-source software, and the subscription terms define exactly what you receive. The commercial relationship is separate from the open-source license, so you should review both before signing.
- Commercial subscription: You pay NetKnights on a subscription basis. Ask for the billing unit, the term, the renewal conditions and the notice periods in writing.
- Vendor support: A named vendor provides support. Ask for response targets, severity definitions and the escalation path, and do not assume service levels that are not in a signed document.
- Enterprise feature list: Features that differ from the community build are defined by NetKnights and can change between versions. Get the current list in writing and map each item to your requirements.
- Patch and release terms: Ask how security fixes reach subscribers, whether they are backported to older versions, and how long a version stays supported.
- Shared core and add-ons: Confirm which parts of the Enterprise Edition are the same AGPLv3 core you can run yourself, and which license terms apply to any proprietary add-ons.
Ask NetKnights for the current feature list, support terms and exit terms, then compare the subscription against the internal staff time that community support would require.
privacyIDEA.org states that the project is not ruled by a single company, although only one company is currently involved. For a control that sits in front of VPN access and logons, the practical questions are who sets the roadmap, who maintains releases and what happens if that company's priorities change. The answers affect how much internal capability you need.
- Single active company: Only one company is currently involved, so maintenance and feature work depend heavily on that group. Treat this as a concentration risk in your vendor review.
- Continuity under the license: AGPLv3 lets you keep running and modifying the version you have, so plan for a pinned version or an internal fork if development slows.
- Visible roadmap activity: Follow the public release notes and issue tracker, and keep dated records of how fixes and features move. These records support procurement and audit questions.
- Internal capability: Keep staff who can deploy, patch and troubleshoot the server, because you may need to operate it without outside help for a period.
- Exit terms in the contract: If you buy the Enterprise Edition, agree in writing what happens to support, updates and access if the subscription ends.
Record this governance assessment alongside your license review so the decision can be traced during procurement and audit.
What drives cost on each side
Duo's cost is mostly a recurring subscription that scales with users and edition. privacyIDEA moves the bill to infrastructure, support choices, token purchases and staff time, so the comparison depends on how your organization carries each of those lines.
Duo per-user subscription
This is the recurring line on the Duo side. The main drivers are the number of users billed, the edition you hold and any add-on features you rely on for device trust or risk signals. Confirm with your Duo account team which users are counted, how contractors and service accounts are treated, and whether renewal pricing changes at term end. Ask for the cost per user for each edition you are comparing, not a bundle total.
privacyIDEA servers and high availability
privacyIDEA runs on your own servers, so the recurring cost is infrastructure: at least two nodes for high availability, a database, load balancing, monitoring and backups, all inside your network or data center. Ask your infrastructure team to cost compute, storage and staff hours for patching, and to state where the RADIUS and LDAP traffic must stay. These costs grow with sign-in volume and the number of sites you cover.
Optional Enterprise subscription
The core project is AGPLv3 licensed, and the privacyIDEA Enterprise Edition is available from NetKnights. Whether you need that subscription depends on support expectations, service levels and features your security team requires. Ask NetKnights for its current edition terms, what support covers, and whether pricing is per user, per server or flat. Treat it as a separate line item from the open-source core.
SMS and messaging delivery fees
If users receive one-time codes by SMS or email, your organization pays the carrier or mail provider for each message, and those fees recur with usage. Duo and privacyIDEA both support SMS factors, so this cost applies to either side unless you limit SMS to a fallback. Ask for your expected monthly message volume, the carrier rates by country, and whether your SMS gateway contract has minimum commitments.
Hardware tokens and replacements
Hardware OTP tokens, FIDO2 keys and smartcards carry a purchase cost, usually one time for the initial rollout and then recurring for lost, damaged or expired devices. Migrating existing hardware tokens can avoid some purchases when seed files can be imported. Ask for the unit price, replacement lead time, the share of users expected to need a spare, and whether the vendor offers volume pricing for FIDO2 keys.
Implementation, integration and help desk
Setup work is mostly one-time: resolver configuration against LDAP or Active Directory, RADIUS for VPNs, the Windows credential provider, PAM on Linux and the enrollment process. Enrollment support and lost-device resets then recur as ongoing help desk effort, which self-managed MFA shifts onto your staff. Request a written scope listing each integration, the enrollment workflow, the help desk runbook and the hours assumed for each, so you can compare it with the time your team spends on Duo today.
What a move from Duo to privacyIDEA involves
The sequence turns Duo's user, device and token records into a privacyIDEA deployment that authenticates the same people on the same services before the Duo contract ends. Each step closes with a check the team can verify.
Inventory users, phones and tokens in Duo
Your Duo administrator exports users, enrolled phones, hardware tokens, integrations and recent authentication logs through the Duo Admin API, using an admin API application with read permissions. Confirm with Duo which plan and API access your contract includes and what the rate limits are, because those settings decide how long the export takes. Record which applications, VPNs and Windows or Linux systems depend on each integration. The step is done when every Duo integration has a matching row in the inventory and a named owner.
Map users to the directory of record
Decide which directory privacyIDEA will read from, typically Active Directory or another LDAP service, and configure it as a user ID resolver. Compare the Duo usernames with the directory attributes so that each person resolves to exactly one account, and resolve duplicates or stale accounts before cutover. Your identity team owns the attribute mapping and the service account that privacyIDEA uses for lookups. The step is done when a sample of users resolves correctly and a test login reaches the right account.
Import hardware token seeds
Only tokens whose seeds your organization can legally and technically obtain can be moved. privacyIDEA imports seed files in SafeNet XML, OATH CSV, Yubikey CSV and PSKC formats, and it can import GPG-encrypted seed files with its own GPG key. Confirm with your token vendor and Duo what seed export is available for each hardware model, because not every token type can be exported. Assign each imported token to the correct user and test one OTP per token. The step is done when every token in the inventory is either imported and tested or marked for replacement.
Plan Duo Mobile re-enrollment
Push notifications in privacyIDEA require the privacyIDEA Authenticator app, so Duo Mobile users cannot carry their push enrollment across. Standard TOTP and HOTP users can keep apps such as Google Authenticator, which limits how many people must re-enroll. Schedule enrollment in waves by group, publish written instructions, and keep a temporary path for users who have lost their device. The help desk needs a verified identity check before it resets any factor. The step is done when each wave has a completion report and no user remains without a working second factor.
Swap the Duo Authentication Proxy for RADIUS
Point each VPN, firewall and network device that now sends RADIUS requests to the Duo Authentication Proxy at the privacyIDEA RADIUS integration instead. Test with a pilot group first, confirm the shared secrets and the attributes the device expects, and keep the old proxy configuration available until the pilot passes. Network engineers own the device changes, and the identity team owns the privacyIDEA policies. The step is done when each device completes a full login with privacyIDEA and the proxy has no remaining traffic.
Run Windows and Linux PAM rollouts in parallel
Deploy the privacyIDEA Windows credential provider and the PAM module to pilot hosts while Duo still protects the rest of the estate. Test offline behavior, what happens when the privacyIDEA server is unreachable, and how break-glass accounts are handled before wider rollout. Use configuration management to roll each change across groups of servers, and keep the Duo agent in place until its group is verified. The step is done when every host class has a documented fallback and a tested login.
Cut over and retire Duo
Move each application and device group to privacyIDEA in a planned change window, with a rollback plan and a named owner for every group. Keep Duo read-only for the notice period in your contract, retain exported logs and inventory for your audit and records needs, and remove Duo integrations only after the last group has been confirmed. Your administrators and help desk must be trained and staffed before the first cutover, because they will handle the enrollment questions. The Duo contract end date sets the deadline, so start the inventory early enough to finish every step before it. The step is done when Duo has no active integrations and the records retention decision is signed off.
Questions buyers ask before choosing privacyIDEA over Duo
What drives the cost of running privacyIDEA compared with Duo?
The cost depends on what you run yourself and what you buy. privacyIDEA is licensed under AGPLv3, so the software itself carries no license fee, but you pay for servers, high availability, database operation, SSL certificates, monitoring, and staff time for patching and upgrades. Duo is a per-user subscription that includes hosting and vendor support. Costs that recur for privacyIDEA include infrastructure, SMS messages if you enable them, replacement hardware tokens, and support if you buy the privacyIDEA Enterprise Edition from NetKnights. Ask any implementation partner for a quote that separates one-time work (installation, integration, token import) from recurring items, and compare it with your current Duo invoice line by line.
How long does a Duo to privacyIDEA migration take?
The timeline is set by how many users and tokens you move, how many systems call Duo, and how many ways users must enroll. The main steps are building an inventory of users, phones and hardware tokens, connecting privacyIDEA to your directory, importing token seeds in a supported format, re-enrolling Duo Mobile users, and switching each RADIUS, Windows, SSH and web integration over. Each integration you must cut over, and each group of users who need a new device, adds time. Parallel running, where Duo and privacyIDEA both serve users for a period, reduces risk but extends the project. Confirm the schedule against your own inventory before you agree a fixed-scope plan.
Can our own team migrate from Duo to privacyIDEA without outside help?
A team with Linux administration, directory and RADIUS experience can usually run a privacyIDEA pilot alone, because the project provides documented installation paths with pip and on Ubuntu, CentOS and RHEL-family systems. The harder parts are the ones that touch users and production access: token seed imports, enrollment campaigns, lockout prevention, and cutover of VPN, Windows and SSH logins. Many teams keep their internal staff for operations and bring in outside help for scoped design, integration and hardening. DeployOpen plans, implements and documents this kind of work under a written, fixed scope, and does not issue audit reports or certifications.
What does the migration need from identity, network and help desk staff?
Each group has a distinct role. Identity staff map LDAP or Active Directory attributes to privacyIDEA user ID resolvers and decide who owns policies. Network staff update RADIUS clients on VPNs and firewalls, confirm the shared secrets, and check that the RADIUS ports are reachable from the privacyIDEA server. Help desk staff need scripted enrollment steps, a process for lost devices, and a way to issue temporary access so users are not locked out. Plan these responsibilities before the pilot, and confirm the support model with your vendor and with your own change control rules.
Does push authentication work with privacyIDEA?
Yes, push works, but only through the privacyIDEA Authenticator app. Users who prefer standard TOTP or HOTP can keep apps such as Google Authenticator, so those users do not need the privacyIDEA app for one-time codes. Push requires users to install and enroll the privacyIDEA app, so plan that enrollment as part of the migration from Duo Mobile. Confirm the current push behavior, supported platforms and any server-side requirements with the privacyIDEA project and in a test environment before you rely on it for production logins.
Does privacyIDEA include risk-based authentication policies like Duo?
The privacyIDEA feature set described in its project README covers factor types such as FIDO2, PIV and x509 smartcards, push, TOTP, HOTP, SMS, email and registration codes, along with RADIUS, PAM, Windows and SAML integrations. It does not describe the risk scoring, device trust or adaptive policies that Duo offers, so treat that as a gap to verify. If your Duo policies depend on risk signals, document them now, decide which ones you will replace with fixed rules such as network location or group membership, and test those rules with your security team before cutover. Ask the vendor to confirm the exact policy options in the current release.
How DeployOpen helps evaluate, implement and migrate
DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure. For Cisco Duo vs privacyIDEA, we work from a written scope that sets out which factors, integrations and sites are in play before any build starts.
How we scope
- Inventory which Duo factors, RADIUS clients, Windows logons and SSO apps need replacing, and which must keep working.
- Confirm whether sites are air-gapped or bound by sovereignty rules, since that changes the deployment and integration design.
- Agree deliverables, timelines and responsibilities in writing; engagements are fixed-scope and ongoing support is available as a retainer.
How we build
- Deploy privacyIDEA in your environment and connect user ID resolvers to your existing LDAP or Active Directory sources.
- Configure RADIUS, PAM, Windows credential provider and SSO integrations, then test each flow against documented expected behavior.
- Run security testing of the MFA endpoints and enrollment paths, and document the results and remediation actions.
How we hand over
- Deliver architecture records, configuration documentation and runbooks for enrollment, token management and recovery.
- Prepare a cutover plan with a rollback path, a user communication plan and a lockout-prevention procedure for the help desk.
- Provide evidence and control documentation that your internal team or an independent auditor can review for compliance readiness.
How we support
- Offer retainers for upgrades, patching, backups and continuous testing of the privacyIDEA deployment after go-live.
- Plan version upgrades against the release notes of each privacyIDEA release before applying them to production.
- Ask any provider, including us, to confirm support terms, response commitments and enterprise subscription options in writing.
