> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/configuration/duo-integration.md). # DUO Integration Combining Duo with M365 gives you full visibility into MFA posture across both sides of a user's authentication setup. Augmentt's Duo integration monitors your Duo MFA configuration alongside M365 conditional access policies, so you can catch accounts that are set up without MFA or that degrade in posture over time (for example, being bypassed for too long). {% hint style="warning" %} **Prerequisite:** Duo for Microsoft Entra ID (formerly Azure AD) requires a Conditional Access Policy actively enforcing Duo MFA. Confirm this policy is in place *before* connecting the integration — without it, MFA status reporting will be inconsistent. See Duo's own documentation: "Duo Two-Factor Authentication for Microsoft Entra ID." {% endhint %} ## Prerequisites * M365 already integrated with Augmentt. See [M365 Integration & Permissions](/configuration/m365-integration-and-permissions.md) if you haven't set that up yet. * An active Duo Accounts API (and optionally Admin API) credential set. ## Setup steps 1. In the Augmentt portal, go to **Configuration > Integrations**. Duo is integrated at the **Organization** level — choose your MSP Organization from the company selector. 2. Click **Connect** on the Duo integration card. 3. Enter your Duo **Accounts API** settings: Integration Key, Secret Key, and API hostname. (Find these in Duo's own admin panel under Accounts API.) 4. **If your MSP's Duo is set up at the organizational level** (i.e., one Duo account spans multiple client Duo sub-accounts), check **Has Admin API Settings** and add your Duo Admin API credentials. This requires the following Duo Admin API permissions: * Grant administrators * Grant read log * Grant read resource If you instead have a separate Duo account per client (not a parent/child structure), you can skip this step. 5. Click **Connect**. 6. **Map your accounts:** During initial setup, use the **Manage account mappings** popup to map each Duo client to its corresponding Augmentt customer. You can revisit this mapping anytime from **Integrations > Manage account mappings** on the Duo tile. You can also temporarily disable Duo monitoring for a specific customer by toggling it off here, without disconnecting the whole integration. Once mapped, Augmentt Secure begins monitoring Duo as part of your MFA strategy alongside M365. ## Common issues **MFA status shows "Not Protected" even though the user is registered in Duo and covered by a Conditional Access policy.** This has come up in support cases where all the visible configuration looks correct — the user is in Duo with an email field populated, and the M365 Conditional Access policy enforcing Duo is assigned. If you hit this, verify the exact email in Duo matches the user's actual primary email (not an alias), then contact support with a screenshot of the Duo user record — this typically needs investigation on Augmentt's side rather than a config fix on yours. **MFA status appears correct for some users but wrong for others in the same client.** Reported when a list view (e.g., "150 users not protected") doesn't match what an individual user's detail page shows for the same account. If you see this discrepancy, don't rely on the list-level count for compliance reporting until support confirms the sync is accurate — pull the report again after a fresh sync, and escalate if the mismatch persists. **More than one Duo portal/account in your MSP structure.** If your organization has multiple separate Duo portals (not a single parent account with sub-accounts), account mapping and integration setup may need extra handling — reach out to support before assuming a single connection will cover every Duo portal. **Finding the right customer to map, in a large customer list.** The account-mapping screen requires paging through your full customer list to find the one you want to map to Duo; there's no search/filter field on that specific view today. If you manage many customers, budget extra time for this step. {% hint style="info" %} Feature requests around searchable/filterable customer selection on the Duo mapping screen have been raised with the product team — if this is a pain point for you, mention it to support so it's tracked against demand. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://helpdesk.augmentt.com/configuration/duo-integration.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.