Deploy Duo Desktop to Microsoft Intune
Duo SecurityWindowsversion 7.22.0, 6 October 2026
Duo Desktop is in the PatchBee catalog as a Windows app from Duo Security, synced from the Windows Package Manager community repository (winget). Pick it in the App Library and PatchBee writes the deployment plan below, builds the package, publishes it to your Intune tenant and assigns it to the Entra groups you choose. New versions then follow through your update rings.
The plan PatchBee writes
Duo Desktop as an Intune app
The standard form for a MSI (WiX) (x86 (32-bit), per machine). The real plan is generated from the installer when you package, and shown in full before anything is published; every field can be changed.
- Intune app type
- Windows app (Win32), .intunewin
- Install
- msiexec /i "DuoDesktop.msi" /qn /norestart
- Uninstall
- msiexec /x {BFE73F5E-6760-4367-980F-FAC8B3CDFDE8} /qn /norestart
- Detection
- MSI product code. Product code {BFE73F5E-6760-4367-980F-FAC8B3CDFDE8}, version 7.22.0 or newer.
- Requirements
- x86 (32-bit) · per machine
Installers in version 7.22.0
| Architecture | Type | Scope | Hash |
|---|---|---|---|
| x86 (32-bit) | MSI (WiX) | per machine | SHA-256 published |
PatchBee downloads the installer from the publisher's own URL and verifies its SHA-256 against the catalog before packaging. "None published" means the source carries no hash for this download, so that check has nothing to compare against; packaging still works.
Silent install switches
Recorded for Duo Desktop in its winget manifest. PatchBee uses them as the installer's unattended switches, so the package installs without a click.
- Install location
- INSTALLFOLDER="<INSTALLPATH>"
About Duo Desktop
Duo Desktop, formerly known as Duo Device Health, gives organizations more control over which laptop and desktop devices can access corporate applications based on the security posture of the device or presence of Duo Desktop installed on the endpoint.
There are three key components:
1. Duo access policies that enforce application access based on device health.
2. A native client application for supported Linux, macOS, and Windows clients that checks the security posture of the device when a user authenticates to an application protected by Duo's browser-based prompt with an applied Duo Desktop policy.
3. Additional endpoint information provided in the Duo Admin Panel.
The first time users log in to an application protected by the web-based Duo Universal Prompt or traditional Duo Prompt with the Duo Desktop policy set to require the app, Duo prompts them to download and install Duo Desktop. After installing Duo Desktop, Duo blocks access to applications through the Duo browser-based authentication prompt (when displayed in a browser or in a supported thick client's embedded browser) if the device is unhealthy based on the Duo policy definition and informs the user of the reason for denying the authentication.
- Publisher
- Duo Security
- Homepage
- duo.com/docs/duo-desktop
- License
- Proprietary
- Source
- winget · DuoSecurity.DuoDesktop
- Versions in catalog
- 8
Also in the catalog for the other platform: Duo Desktop for macOS
How this becomes an app in your tenant
Sign in with your Microsoft work account and connect your Intune tenant once. Find Duo Desktop in the App Library, open its plan (the commands, detection rule and requirements above, editable) and publish: PatchBee downloads and verifies the installer, builds the package, creates the Intune app and assigns your groups. When Duo Security ships a new version, PatchBee detects it and rolls it out through your rings, with supersedence and rollback.
Read the step-by-step guideMore Windows apps
Catalog data as of 11 October 2026, from the Windows Package Manager community repository (winget). The product re-reads the source every night and plans against the live catalog, so the version here may already be one behind. Nothing is published to a tenant without an administrator approving the plan.