Skip to main content
The Duo Accounts integration uses one set of keys in your Duo MSP account to create and delete subaccounts, manage their users and groups, and read their logs. For phones, tokens or administrators, use Duo in the client’s own account; to verify people, use Duo Auth. You need the Owner role in a Duo MSP account (or another account that can create subaccounts). Duo moved subaccount management into the Admin API in June 2026; existing Accounts API keys still work.

​
Set up Duo

1

Add an Admin API application

In the Duo Admin Panel for your main account, go to Applications → Application Catalog, find Admin API and click + Add. You don’t need one per subaccount.
2

Grant subaccount permissions

Under Subaccount permissions, tick what your workflows need and click Save. If you fill in Networks for API Access, include Triggr’s outbound IP addresses.
3

Copy the application details

Copy the Integration key, Secret key and API hostname from Details.

​
Connect it in Triggr

1

Open the integration

Go to Integrations > Duo Accounts and click Configure on the Base Configuration card.
The Base Configuration card with Status Not Configured, Admin Consent Not Required and a Configure button.
2

Enter the application details

Enter Hostname as https:// plus the API hostname, with no trailing / or path (for example https://api-XXXXXXXX.duosecurity.com), add the SecretKey and IntegrationKey, then click Save Configuration.
The Duo Accounts configuration window with Hostname, SecretKey and IntegrationKey fields, an Allow insecure TLS switch under Advanced, and a Save Configuration button.

​
Map your clients

On the Client Mapping card, click Apply 100% Matches, then choose the subaccount in Mapped to for anyone left. Triggr saves each match as the client’s duoAccountId (the subaccount’s account ID, starting DA) and duoApiHostname variables.
The Client Mapping card with All, Mapped and Unmapped filters, Acme Corp mapped to Acme Corp with a 75% suggested mapping, and Globex unmapped with a Select ConnectWise Manage clients dropdown.

The Client Mapping card, shown here for ConnectWise Manage as an example.

In subaccount actions, set Duo Account Id (reads and deletes) or Account Id (creates and changes) to {{ ctx.client.duoAccountId }}. Without it, Duo answers for your main account.

​
Troubleshooting

Check the application has Grant accounts - Read and its keys come from your main account, not a subaccount. Then click Refresh on Client Mapping.
40102 means IntegrationKey is wrong or from a different account to Hostname. 40103 means SecretKey is wrong (perhaps reset in Duo) or Hostname has a trailing / or path.
Tick the subaccount permission the action needs in the Duo Admin Panel and click Save.
Set the action’s Duo Account Id or Account Id to {{ ctx.client.duoAccountId }} and check the client is mapped.
Add Triggr’s outbound IP addresses to the application’s Networks for API Access.