Duo is a multi-factor authentication (MFA) and access-security product, not a full identity provider. Duo decides who may sign in to an application through permitted groups and policies, not through per-user assignments, so Oleria shows group-level access plus the users who actually signed in - see Known limitations.
What Oleria discovers
Once connected, Oleria continuously discovers and maps the following from your Duo Security account:- Users - every end user in the Duo directory, including directory-synced users from Active Directory, Microsoft Entra ID, Google Workspace, or OpenLDAP, with their enrolled authentication methods, MFA status, last login, last Duo Directory password change, and any bypass codes issued to them.
- Administrators - every administrator of the Duo Admin Panel, a separate principal class from end users, with their administrator role and, for administrators restricted to administrative units, the groups and applications that role covers.
- Roles - every Duo administrator role, including custom roles, which administrators hold each one, and any external directory groups that assign a role to synced administrators.
- Groups - Duo groups and each user’s group memberships.
- Protected applications - every application integration registered in Duo, including Duo Single Sign-On applications, the groups permitted to use each one, and its technical and business owners.
- Non-human identities - each integration’s API credential (integration key and secret key), Admin API applications with the access their Admin API permissions give them to every application, and the OAuth clients of Duo Single Sign-On OAuth servers with their scopes.
- Application access - group access from each application’s permitted groups, and the users who successfully authenticated to each application in the last 30 days.
- Risks - open Duo Trust Monitor events (anomalous authentications, users or groups put in bypass, risky device registrations), where your Duo plan includes Trust Monitor.
- Activity - authentication events (successful, failed, denied, and fraud-flagged logins), administrator activity (configuration changes made in the Admin Panel or through the API), and MCP authorization decisions for OAuth clients, for up to 180 days.
Prerequisites
- A paid or trial Duo edition. Duo’s free edition does not include the Admin API.
- A Duo administrator with the Owner role. Only Owners can create or modify an Admin API application.
- Oleria doesn’t need the Grant settings permission, which can also change global Duo settings. Without it, Oleria identifies your Duo account by its API hostname.
Create a dedicated Admin API application for this integration rather than reusing one created for another tool, so its permissions match what Oleria needs and it can be rotated or removed on its own.
Create an Admin API application in Duo
1
Open the application catalog
Sign in to the Duo Admin Panel as an Owner, navigate to Applications -> Application Catalog (Protect an Application in older Admin Panels), find Admin API, and click + Add.
2
Grant permissions
On the new Admin API application, under Permissions, grant the read permissions Oleria needs to discover your account:
To let Oleria run remediation actions, also grant the write permissions for the actions you plan to use:
Click Save Changes.
Oleria checks the application’s own permissions before it runs an action, so a missing write permission is reported up front instead of failing part-way through.
3
Copy the credentials
From the application’s Details section, copy the Integration key, Secret key, and API hostname (shown as
api-XXXXXXXX.duosecurity.com).Connect Duo Security to Oleria
1
Open the integration
Sign in to your Oleria workspace, navigate to Integrations, and select Duo Security.
2
Complete the connection form
Fill in the connection form with the credentials from the Admin API application:
3
Authenticate
Select Authenticate to validate and save the integration. Oleria checks the credentials against Duo before saving.
Verify the integration
Confirm the Duo Security instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered users, administrators, groups, and applications in your Oleria workspace. If the Admin API application lacks Grant read log, the activity sync reports the missing permission rather than showing an account with no activity.Remediation actions
Beyond discovery, Oleria can act on Duo access to remediate risk. Each action needs the Admin API permission listed for it.Known limitations
- Application access comes from permitted groups and sign-ins. Duo doesn’t store per-user application assignments. Oleria shows the groups permitted to use each application, and the users who successfully signed in to it in the last 30 days. An application open to all users isn’t expanded into a per-user list, and access isn’t revoked per user from Oleria because Duo has no per-user grant to remove.
- Directory-synced users are read-only. A user synced from Active Directory, Microsoft Entra ID, Google Workspace, or OpenLDAP is managed by that directory - any change to such a user reverts on the next directory sync. Oleria flags these accounts as directory-managed so you can make the change in the directory instead.
- Plan-dependent data. Custom administrator roles and administrative units need a Duo edition with administrative roles; Trust Monitor events are available only on Duo Advantage and Premier accounts created before September 29, 2025, and Duo ends Trust Monitor support on January 31, 2027. Where your account doesn’t offer one of these, Oleria skips that data and keeps syncing everything else.
- Missing “Grant administrators - Read” permission degrades visibly. If the Admin API application lacks this permission, Oleria still syncs but represents the unenumerated administrator population as a single placeholder group rather than omitting it silently.
- MSP subaccounts are not synced. Each MSP child account requires its own separate Oleria connection.
- Audit retention - Duo keeps logs available through the API for 180 days, and holds back the newest two minutes of events, so the latest activity appears in the next sync.