{"id":75700,"date":"2023-06-05T13:11:20","date_gmt":"2023-06-05T17:11:20","guid":{"rendered":"https:\/\/jumpcloud.com\/?post_type=support&#038;p=75700"},"modified":"2023-09-12T10:55:29","modified_gmt":"2023-09-12T14:55:29","slug":"configure-duo-security-mfa","status":"publish","type":"support","link":"https:\/\/jumpcloud.com\/support\/configure-duo-security-mfa","title":{"rendered":"Configure Duo Security MFA"},"content":{"rendered":"\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card important\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Important:<\/strong> \n<p>Duo is ending support for the traditional Duo two-factor authentication prompt on March 30, 2024. JumpCloud supports Duo universal prompt and recommends admins update to that method.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<p>Use Multi-factor Authentication with JumpCloud to secure user access to your organization\u2019s resources, and enable JumpCloud Duo Security MFA to give your users the ability to use push notifications as a factor when MFA guards the User Portal and SSO applications.<\/p>\n\n\n\n<p>Read this guide to learn how to configure Duo Security for your org. Duo Security MFA gives your users the ability to authenticate to the User Portal and SSO applications with push notifications.<\/p>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card tip\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Tip:<\/strong> \n<p>You can also secure user access to resources with JumpCloud Protect, TOTP MFA, and WebAuthn MFA. See <a href=\"https:\/\/jumpcloud.com\/support\/mfa-for-admins\" target=\"_blank\" rel=\"noreferrer noopener\">MFA for Admins<\/a> to learn more.&nbsp;<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">About Duo Security MFA&nbsp;&nbsp;<\/h2>\n\n\n\n<p>MFA requires more than one factor to authenticate to a resource. Duo Security MFA allows users to authenticate to their User Portal using push notifications, phone callbacks, and mobile passcodes provided by Duo. Duo Security MFA is available for User Portal login, SSO application login, and password changes from the User Portal.&nbsp;<\/p>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Note:<\/strong> \n<p>JumpCloud\u2019s Duo MFA integration does not include support for Duo System Agent Authentication for Windows, which is a different Duo component for use cases not related to MFA.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Duo Security MFA Considerations<\/h2>\n\n\n\n<p>Read and understand the following considerations prior to enabling Duo Security MFA.<\/p>\n\n\n\n<ul>\n<li>Users must be enrolled in Duo to use Duo as a MFA. JumpCloud doesn\u2019t enroll users in Duo.<\/li>\n\n\n\n<li>The JumpCloud username must be the same as the Duo enrolled username. Alternatively, you can create an alias for the username in Duo to match the JumpCloud username. You can do this in the Duo Admin Panel below a user\u2019s username.<\/li>\n\n\n\n<li>JumpCloud integrates with Duo but doesn\u2019t manage Duo. You need an account in Duo with administrative access to create the required Duo application.<\/li>\n\n\n\n<li>To configure Duo to protect the JumpCloud User Portal, you need to use the Duo Web v4 SDK application.<\/li>\n\n\n\n<li>Third party integrations may not support Duo MFA.&nbsp;<\/li>\n\n\n\n<li>At least one MFA factor must always be enabled for the User Portal, and you can have more than one MFA factor enabled.<\/li>\n\n\n\n<li>TOTP MFA is enabled by default in MFA Configurations, but if Duo is turned on TOTP can then be turned off.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Preparing Your Users<\/h2>\n\n\n\n<p>When you enable Duo security for your organization, users will also need a Duo account to make use of it as an MFA factor.&nbsp;If multiple MFA factors are enabled, users will have the option to choose which MFA factor they want to use to authenticate to the User Portal. If Duo MFA fails to authenticate a user, the user can change to an alternative MFA factor.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"create-duo-app\">Creating a Duo Application in Duo<\/h2>\n\n\n\n<p>To begin using Duo MFA, you first need to configure a Duo application in Duo for the JumpCloud User Portal.<\/p>\n\n\n\n<p>To create a Duo application, you will need to be an administrator with a <a href=\"https:\/\/signup.duo.com\/\">Duo account<\/a>. Once that is complete, you can log into the Duo Admin Panel as an administrator and follow the instructions in the First Steps section of the Duo documentation.<\/p>\n\n\n\n<ul>\n<li>Duo Admin Panel:<a href=\"https:\/\/admin.duosecurity.com\/\" target=\"_blank\" rel=\"noreferrer noopener\"> https:\/\/admin.duosecurity.com\/<\/a><\/li>\n\n\n\n<li>Duo Universal Prompt documentation: <a href=\"https:\/\/duo.com\/docs\/duoweb#overview\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/duo.com\/docs\/duoweb#overview<\/a><\/li>\n<\/ul>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Note:<\/strong> \n<p>Be sure to collect your Integration Key (Client ID), Secret Key (Client Secret), and API Hostname from the Applications area of the Duo Admin Panel.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Enabling Universal Prompt<\/h2>\n\n\n\n<p>Migrating to Universal Prompt for your Duo applications is a two-step process:<\/p>\n\n\n\n<ul>\n<li>Update the application to support the Universal Prompt with the Duo Web v4 SDK.<\/li>\n\n\n\n<li>Activate the Universal Prompt experience for your users.<\/li>\n<\/ul>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Note:<\/strong> \n<p>If the admin does not migrate to the Universal Prompt experience, users will continue to see the traditional prompt.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ul>\n<li>Complete Instructions: &nbsp;<a href=\"https:\/\/duo.com\/docs\/duoweb#overview\">https:\/\/duo.com\/docs\/duoweb#overview<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Protecting the User Portal with Duo MFA<\/h2>\n\n\n\n<p><strong>To enable Duo Security for your organization<\/strong>:<\/p>\n\n\n\n<ol>\n<li>Log in to&nbsp; the JumpCloud Admin Portal: <a target=\"_blank\" href=\"https:\/\/console.jumpcloud.com\/\" rel=\"noreferrer noopener\">https:\/\/console.jumpcloud.com<\/a>.&nbsp;<\/li>\n\n\n\n<li>Go to <strong>Security Management &gt; MFA Configurations<\/strong>.<\/li>\n\n\n\n<li>Enable Duo Security by clicking <strong>Configure<\/strong>.<\/li>\n\n\n\n<li>Enter (paste) the following information that you collected from Duo: \n<ul>\n<li>Integration Key (Client ID)<\/li>\n\n\n\n<li>Secret Key (Client Secret)<\/li>\n\n\n\n<li>API Hostname&nbsp;<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Click <strong>Save<\/strong>.&nbsp;<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">User Experience<\/h2>\n\n\n\n<p>When you configure the Duo Security MFA connection in JumpCloud and require TOTP for a user, this will be the user experience:<\/p>\n\n\n\n<ol>\n<li>Log in to the JumpCloud User Portal <a target=\"_blank\" href=\"https:\/\/console.jumpcloud.com\/login\" rel=\"noreferrer noopener\">https:\/\/console.jumpcloud.com\/login<\/a>.<\/li>\n\n\n\n<li>Choose a multifactor authentication method.<\/li>\n\n\n\n<li>If choosing to use Duo, you&#8217;ll be challenged for Duo MFA after entering your password. Depending on your device and what has been configured for use with Duo MFA, possible options are:\n<ul>\n<li>Duo Push (User will receive a prompt in the Duo app)<\/li>\n\n\n\n<li>Passcode (User will need to enter a passcode that&#8217;s texted via SMS)<\/li>\n\n\n\n<li>Call Phone (User will receive a phone call from Duo for authentication)<\/li>\n\n\n\n<li>Touch ID<\/li>\n\n\n\n<li>Use Security Key&nbsp;<\/li>\n\n\n\n<li>Send Text Message Passcode (User will receive a passcode as a text message)<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Note:<\/strong> \n<ul>\n<li>Universal Prompt will remember the last authentication method used and default to that method. Clicking <strong>Other Options<\/strong> will give the user other approved methods.<\/li>\n\n\n\n<li>(Limitation) Duo Universal Prompt does not return the user to the prompt screen in the case of an error, denial, or time-out. The user has to click the browser back button twice to return to the prompt screen.<\/li>\n\n\n\n<li>(Tip)&nbsp;If multiple MFA factors are enabled, you can choose your authentication method.<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ol start=\"4\">\n<li>After successfully authenticating through the chosen method, you should be logged in to your User Portal.&nbsp;&nbsp;<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Note:<\/strong> \n<p>&nbsp;If a user account is set to Bypass in Duo, they\u2019ll never see the Duo authentication options when signing in. Rather, they are automatically logged in to the User Portal via Duo. This could confuse users if they&#8217;re expecting to see Duo\u2019s authentication methods after entering their password.<\/p>\n <\/div><\/div><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Use Multi-factor Authentication with JumpCloud to secure user access to your organization\u2019s resources, and enable JumpCloud Duo Security MFA to [&hellip;]<\/p>\n","protected":false},"author":204,"featured_media":0,"template":"","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"support_category":[2908,2854],"support_tag":[],"coauthors":[2838],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v22.9 (Yoast SEO v22.9) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Configure Duo Security MFA - JumpCloud<\/title>\n<meta name=\"description\" content=\"Learn how to configure Duo Security as an MFA factor.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jumpcloud.com\/support\/configure-duo-security-mfa\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Configure Duo Security MFA\" \/>\n<meta property=\"og:description\" content=\"Learn how to configure Duo Security as an MFA factor.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jumpcloud.com\/support\/configure-duo-security-mfa\" \/>\n<meta property=\"og:site_name\" content=\"JumpCloud\" \/>\n<meta property=\"article:modified_time\" content=\"2023-09-12T14:55:29+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/07\/202405-MISC-JumpCloudHelpCenter-SiteDisplay-min-2.png\" \/>\n\t<meta property=\"og:image:width\" content=\"890\" \/>\n\t<meta property=\"og:image:height\" content=\"525\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"5 minutes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data2\" content=\"jenniferklein\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jumpcloud.com\/support\/configure-duo-security-mfa\",\"url\":\"https:\/\/jumpcloud.com\/support\/configure-duo-security-mfa\",\"name\":\"Configure Duo Security MFA - JumpCloud\",\"isPartOf\":{\"@id\":\"https:\/\/jumpcloud.com\/#website\"},\"datePublished\":\"2023-06-05T17:11:20+00:00\",\"dateModified\":\"2023-09-12T14:55:29+00:00\",\"description\":\"Learn how to configure Duo Security as an MFA factor.\",\"breadcrumb\":{\"@id\":\"https:\/\/jumpcloud.com\/support\/configure-duo-security-mfa#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jumpcloud.com\/support\/configure-duo-security-mfa\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jumpcloud.com\/support\/configure-duo-security-mfa#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jumpcloud.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Support\",\"item\":\"https:\/\/jumpcloud.com\/support\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Configure Duo Security MFA\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jumpcloud.com\/#website\",\"url\":\"https:\/\/jumpcloud.com\/\",\"name\":\"JumpCloud\",\"description\":\"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.\",\"publisher\":{\"@id\":\"https:\/\/jumpcloud.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jumpcloud.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/jumpcloud.com\/#organization\",\"name\":\"JumpCloud\",\"url\":\"https:\/\/jumpcloud.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"width\":598,\"height\":101,\"caption\":\"JumpCloud\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Configure Duo Security MFA - JumpCloud","description":"Learn how to configure Duo Security as an MFA factor.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jumpcloud.com\/support\/configure-duo-security-mfa","og_locale":"en_US","og_type":"article","og_title":"Configure Duo Security MFA","og_description":"Learn how to configure Duo Security as an MFA factor.","og_url":"https:\/\/jumpcloud.com\/support\/configure-duo-security-mfa","og_site_name":"JumpCloud","article_modified_time":"2023-09-12T14:55:29+00:00","og_image":[{"width":890,"height":525,"url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/07\/202405-MISC-JumpCloudHelpCenter-SiteDisplay-min-2.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"5 minutes","Written by":"jenniferklein"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/jumpcloud.com\/support\/configure-duo-security-mfa","url":"https:\/\/jumpcloud.com\/support\/configure-duo-security-mfa","name":"Configure Duo Security MFA - JumpCloud","isPartOf":{"@id":"https:\/\/jumpcloud.com\/#website"},"datePublished":"2023-06-05T17:11:20+00:00","dateModified":"2023-09-12T14:55:29+00:00","description":"Learn how to configure Duo Security as an MFA factor.","breadcrumb":{"@id":"https:\/\/jumpcloud.com\/support\/configure-duo-security-mfa#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jumpcloud.com\/support\/configure-duo-security-mfa"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/jumpcloud.com\/support\/configure-duo-security-mfa#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jumpcloud.com\/"},{"@type":"ListItem","position":2,"name":"Support","item":"https:\/\/jumpcloud.com\/support"},{"@type":"ListItem","position":3,"name":"Configure Duo Security MFA"}]},{"@type":"WebSite","@id":"https:\/\/jumpcloud.com\/#website","url":"https:\/\/jumpcloud.com\/","name":"JumpCloud","description":"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.","publisher":{"@id":"https:\/\/jumpcloud.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jumpcloud.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/jumpcloud.com\/#organization","name":"JumpCloud","url":"https:\/\/jumpcloud.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","width":598,"height":101,"caption":"JumpCloud"},"image":{"@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/75700"}],"collection":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support"}],"about":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/types\/support"}],"author":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/users\/204"}],"version-history":[{"count":3,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/75700\/revisions"}],"predecessor-version":[{"id":92101,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/75700\/revisions\/92101"}],"wp:attachment":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/media?parent=75700"}],"wp:term":[{"taxonomy":"support_category","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support_category?post=75700"},{"taxonomy":"support_tag","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support_tag?post=75700"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/coauthors?post=75700"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}