Sign in to ISC with AD account but utilize entra ID's conditional access to Duo

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Been scouring around documentations hoping I’ll find the right one but cant seem to get the information I need.

Here’s my use case

  1. User Sign In to ISC
  2. Authenticates via Duo enforced by Entra ID
  3. Logs in

I have duo integrated with Entra ID (Duo Two-Factor Authentication for Microsoft Entra ID EAM | Duo Security)
we also have the conditional access policy set up to prompt for duo when user sign in.

Do I need to configure Global > Service Provider > IdP?
I’m hoping someone can enlighten me the instruction how to set this up or docs. I would greatly appreciate it.

1 Like
2

Hi Lucky,

If I understood your requirement correctly, you want to use pass-through authentication using “Active Directory” and also enable cisco DUO as MFA for users signing into your SailPoint ISC tenant.

This can be achieve using “sign-in method” in Identity Profile: Creating Identity Profiles - SailPoint Identity Services

But if you are trying to configure SSO using IdP as Entra ID and want cisco DUO as external MFA, this YouTube video might be helpful: https://youtu.be/o3SAv2iabcw?si=XZitWobEdJ1_CYoD. You then have to configure the “Service Provider” in Security Settings as you mentioned.

3

Thank you Amar!

I do would like to expand on this one
" This can be achieve using “sign-in method” in Identity Profile: Creating Identity Profiles - SailPoint Identity Services"

Is there a way to enforced Duo prompt after the user sign in, same as Duo Web integration when they reset password/unlock account?

1 Like
4

Hi @lbasco1,

Yes, a similar one. If you enable “Multifactor Authentication” in the Identity Profile with target users, SailPoint do not restrict which MFA tool you can use. All users in that Identity Profile would be required to setup up an authenticator app and you can guide the users to use “Duo Mobile” app.

Note: The end user can still configure google authenticator or any other authenticator if he/she wants. Also there would not be any push notifications, the user have to open the authenticator app/Duo Mobile and type/copy the code that is refreshed every 30 seconds.

I understand it would be way better for user experience if a prompt/push notification is possible in sign-in like the “two-factor authentication” while password reset.

5

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.