
Working alongside Duo’s authentication prompt, this endpoint agent checks device posture, including FileVault, firewall, system password and installed security agents, before granting access to protected apps. Blocked users get guided remediation steps. It can also serve as a same-device 2FA method, and IT can deploy it silently via MDM. Requires a Duo subscription.
anchor apple generic and identifier "com.duosecurity.duo-device-health" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = FNN8Z5JMFP)