You do not need to set up or disconnect an AI Gateway to turn off GitLab Duo. Use GitLab’s availability controls to disable Duo at the scope you choose; on Self-Managed, set it to Always off to prevent lower-level settings from turning it back on. Disable selected AI-native features or Agent Platform separately when needed.
Choose the right control for your GitLab installation
GitLab Duo availability and AI Gateway configuration do different jobs. Availability controls whether users can access Duo features; gateway configuration concerns how AI requests are routed or which models are used. GitLab documents GitLab.com AI Gateway as the default route for Self-Managed Duo configuration and also documents a self-hosted gateway option. Changing gateway settings alone is not documented as a way to disable user-facing features. Start with the availability control that matches your installation and desired scope.
As an Amazon Associate I earn from qualifying purchases.
| What you want to turn off | Control to use | Scope or effect |
|---|---|---|
| GitLab Duo across a Self-Managed instance | GitLab Duo availability: Always off | Instance-wide; child entities cannot override it. |
| GitLab Duo for a group, subgroup, or project | GitLab Duo availability at that group, subgroup, or project | Supported scopes depend on whether you use Self-Managed or GitLab.com. |
| One or more AI-native features | Set each feature to Disabled in AI-native features configuration | Applies to the selected feature or features. |
| Agent Platform experiences | Agent Platform availability setting | Separate from general Duo availability. |
Turn off GitLab Duo for an entire Self-Managed instance
For a full instance lockout, a Self-Managed administrator can set GitLab Duo availability to Always off. GitLab’s Control GitLab Duo availability documentation gives this path:
- Open Admin > GitLab Duo > Change configuration.
- Set GitLab Duo availability to Always off.
- Save the change.
Always off is the locked option: child groups and projects cannot override the instance setting. GitLab distinguishes it from Off by default, which does not itself prevent child settings from changing availability. The distinction is also described in GitLab’s GitLab Duo Feature Availability and Configuration documentation.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Disable Duo at a group, subgroup, or project
If Duo should remain available elsewhere, change availability at the relevant group, subgroup, or project rather than locking the entire Self-Managed instance. GitLab documents instance, group/subgroup, and project controls for Self-Managed; GitLab.com supports group/subgroup and project controls. On GitLab.com, the top-level group owner manages availability, and changes can cascade to lower levels. A change can take up to 10 minutes to take effect.
- Open the GitLab Duo settings for the group, subgroup, or project you want to control.
- Choose the availability option that turns Duo off for that scope, following the labels shown in your GitLab version.
- Save the change and allow up to 10 minutes for it to take effect.
For the current scope-specific instructions, see GitLab’s availability guide. A parent setting may affect descendants, so check the hierarchy if a child scope does not behave as expected.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Disable selected AI-native features
To disable specific AI-native features through the administrator controls, go to Admin > GitLab Duo > Configure models for GitLab Duo > AI-native features and choose Disabled for each feature you want off. GitLab warns: “GitLab Duo features remain turned on even if you have not chosen a model for a feature.” In other words, leaving a model unselected is not a substitute for disabling the feature. See GitLab’s Configure GitLab to use self-hosted models page for this configuration.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Turn off Agent Platform separately
If your goal includes hiding or disabling Agent Platform experiences, use its separate availability control; turning off general Duo availability is not a substitute for checking this setting. In Self-Managed administration, open Admin > GitLab Duo > Change configuration and turn off Agent Platform availability. GitLab says this hides related settings for flows and foundational agents and the AI Catalog. Which items are hidden can vary by offering and version, so follow the applicable instructions in Control GitLab Duo Agent Platform availability.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Check the instructions for your GitLab version
GitLab has separate availability instructions for earlier releases, so a current menu path may not match an older installation. The earlier-version guide covers GitLab 17.7–18.1, 17.4–17.6, and 17.3 and earlier. Use the section for the version you run in Control GitLab Duo availability for earlier GitLab versions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When feature flags are relevant
Self-Managed administrators can disable certain features deployed behind feature flags using the Rails console or Feature Flags API. This is a targeted option for flagged features, not a general replacement for GitLab’s supported Duo availability controls. Consult GitLab’s feature flags guide only when you have a specific flagged feature to manage.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →
