Duo is a multi-factor authentication (MFA) and access-security product, not a full identity provider. Duo knows who authenticated to which application and how strongly, but it is not the system of record for those applications’ entitlements. Access edges below reflect demonstrated authentication activity, not a granted entitlement - see Known limitations.
What Oleria discovers
Once connected, Oleria continuously discovers and maps the following from your Duo Security account:- Users - every end user in the Duo directory, including directory-synced users from Active Directory, Microsoft Entra ID, Google Workspace, or OpenLDAP.
- Administrators - every administrator of the Duo Admin Panel, a separate principal class from end users, along with their administrator role.
- Integration credentials - non-human (NHI) principals such as the Admin API application itself, which holds tenant-wide authority.
- Groups - Duo groups and each user’s group memberships.
- Protected applications - every application integration registered in Duo (the resources users authenticate against).
- Authentication activity - authentication log events, including successful, failed, and fraud-flagged (suspicious) logins, for the last 180 days on paid editions.
Prerequisites
- A paid or trial Duo edition. Duo’s free/Personal edition does not include the Admin API.
- Duo Administrator access, to create an Admin API application.
Create a dedicated Admin API application for this integration rather than reusing employee credentials, to ensure continuity if the employee who provisioned it leaves or changes roles.
Create an Admin API application in Duo
1
Open Applications in the Duo Admin Panel
Sign in to the Duo Admin Panel as an administrator, navigate to Applications -> Protect an Application, and search for Admin API.
2
Grant permissions
Select Protect to create the Admin API application, then grant it the following permissions:Also grant Grant resource write if you want Oleria to perform remediation actions (disabling/enabling users, adding/removing group membership) on this integration:
- Grant resource read
- Grant administrators read
- Grant read log
These three read permissions cover everything Oleria discovers.
3
Copy the credentials
From the application’s details page, copy the Integration key, Secret key, and API hostname (shown as
api-XXXXXXXX.duosecurity.com).Connect Duo Security to Oleria
1
Open the integration
Sign in to your Oleria workspace, navigate to Integrations, and select Duo Security.
2
Complete the connection form
Fill in the connection form with the credentials from the Admin API application:
3
Authenticate
Select Authenticate to validate and save the integration. Oleria checks the credentials against Duo before saving.
Verify the integration
Confirm the Duo Security instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered users, administrators, groups, and applications in your Oleria workspace.Remediation actions
Beyond discovery, Oleria can act on Duo access to remediate risk. Remediation actions require the Admin API application to include the Grant resource write permission (see setup above).Known limitations
- Application access is based on sign-in activity. Duo doesn’t record which applications each user is assigned to. Duo decides access by policy when a user authenticates, and its Policy API isn’t public. Oleria shows that a user has access to an application once it sees a successful authentication. That access stays in Oleria until the authentication event ages out, even if the user loses access sooner.
- No per-application entitlement API. There is no Duo API to grant or revoke a specific user’s access to a specific protected application, so that action isn’t offered from Oleria. User-level deprovisioning and group-membership management, listed above, are supported.
- Directory-synced users are read-only. A user synced from Active Directory, Microsoft Entra ID, Google Workspace, or OpenLDAP is managed by that directory - any change to such a user reverts on the next directory sync. Oleria flags these accounts so remediation isn’t attempted against them.
- Administrator roles may show as a single “Administrator” value. When Oleria can’t determine an administrator’s specific Duo role, it reports a generic “Administrator” role.
- Missing “Grant administrators - Read” permission degrades visibly. If the Admin API application lacks this permission, Oleria still syncs but represents the unenumerated administrator population as a single placeholder group rather than omitting it silently.
- Bypass codes, per-integration API scopes, administrative units, and MSP subaccounts are not synced. Each MSP child account requires its own separate Oleria connection.
- Audit logs - authentication activity has a 180-day retention window on paid editions. The separate Duo administrator action log (changes made in the Admin Panel itself) is not synced as a second activity stream.