Skip to main content
The Duo integration administers a Duo account in full: users, groups, devices, verification pushes, administrators, settings and logs. If your clients are subaccounts of a Duo MSP account, Duo Accounts covers all of them with one set of keys; to verify people, use Duo Auth. Each Duo account needs Duo Premier, Duo Advantage or Duo Essentials (or an Advantage or Premier trial), and you need its Owner role.

​
Set up Duo

Repeat these steps in each Duo account: your own, and each client’s.
1

Add an Admin API application

In the Duo Admin Panel, go to Applications → Application Catalog, find Admin API and click + Add.
2

Grant permissions

Tick what your workflows need and click Save. If you fill in Networks for API Access, include Triggr’s outbound IP addresses.
3

Copy the application details

Copy the Integration key, Secret key and API hostname from Details.
Directory sync actions also need the directory’s key, from Users → Directory Sync. See Duo’s Admin API first steps.

​
Connect it in Triggr

1

Open the account's configuration

Go to Integrations > Duo and click Configure on the client’s row in the Per-Client Configuration card, or on the Base Configuration card for your own account.
The Per-Client Configuration card listing Acme Corp and Globex, each Not Configured with Admin Consent Not Required and a Configure button.
2

Enter the application details

Enter Hostname as https:// plus the API hostname, with no trailing / or path (for example https://api-XXXXXXXX.duosecurity.com), add the SecretKey and IntegrationKey, then click Save Configuration.
The Duo configuration window with Hostname, SecretKey and IntegrationKey fields, an Allow insecure TLS switch under Advanced, and a Save Configuration button.
Per-client integrations never fall back to the Base Configuration, so every client whose workflows use Duo needs its own row.

​
Troubleshooting

40102 means IntegrationKey is wrong or from a different account to Hostname. 40103 means SecretKey is wrong (perhaps reset in Duo) or Hostname has a trailing / or path.
Tick the permission the action needs in the Duo Admin Panel, and check the keys come from an Admin API application, not Auth API.
Configure Duo for that client on the Per-Client Configuration card.
Add Triggr’s outbound IP addresses to the application’s Networks for API Access.