About
The Duo integration brings the users and administrators from your Duo account into ControlMap. It helps you show an auditor who has access to your systems, and whether each person is covered by multi-factor authentication (MFA). ControlMap collects the data on a schedule, so you don't have to export it by hand.
The integration runs these compliance checks:
- All user accounts assigned to an employee / owner
- All users have MFA enabled
- All admins have MFA enabled
Before you start
Have these three values from your Duo account ready:
- Setting up integrations from the client portal is part of the Pro plan. For details, see the Free, Essentials and Pro plans article.
- Integration key
- Secret key
- API hostname
Connect Duo
- Go to Monitor › Integrations and select Add Integration.
- Search for Duo and select the Duo card. It is listed under Identity Providers.
- On the Connection step, enter the Integration key, the Secret key and the API hostname. The secret key is hidden as you type.
- Optional: tick Setup emails discovered as employees in ControlMap. Any new email address ControlMap finds in Duo is then added as an employee. When this is ticked, you can also tick Invite employees to Compliance Portal, which invites each new email address to My Compliance Portal.
- Select Next: Checks. ControlMap gives the connection a name automatically, in the form Integration-duo followed by a number.
Complete the remaining steps as described in the Connect an integration article: Checks, Watchers and Schedule. Duo has no Inclusions & Exclusions step.
What you'll see after connecting
After the first scan, Duo's data appears in two places in Monitor:
- User Accounts: each Duo user and administrator. The Integration column and filter tell your Duo connection apart from your other connections. If you ticked the employee option, each account is linked to the matching person. An account with no matching person is shown as an orphan account.
- Compliance Checks: the three Duo checks. Each check shows No Data until the first scan has finished.
Disconnect or change settings
- To change the keys, hostname, schedule or watchers, open the connection from Monitor › Integrations and use its tabs, as described in the Connect an integration article. Rename the connection with Edit name next to its name.
- To remove Duo, select the bin icon on its card in Monitor › Integrations and confirm. This also deletes the assets and their compliance status.
