Hello, I'm Catherine Zinika. I'm a security customer success specialist, and today I'm going to guide you through your intra external MFA integration with Duo.00:06Alright, in the agenda today we will cover a brief overview about this integration, what we need in order to get started, and we will go through a configuration demo to show you how easy it can be to protect your entry ID tenant with Duo MFA.00:18Finally, we'll wrap up our video with our key takeaways. Alright, let's get started with the overview, the big picture, why the shift matters. So 1st, now we can say it's a native integration.00:33We moved away from the old custom controls method and Duo is now a fully recognized external MFA provider, which means it plays much nicer with Microsoft native conditional access policies. There is modern authentication as well. You get full access to the universal prompt supporting more.00:51Other methods like pass keys, security keys and do a push and there is less admin work. Features like inline enrollment and self service device management are built in. So your team.01:11Spend less time handling all these manual requests. Now let's see some limitations and best practices. 1st ditch the bypass. If you have users set to bypass or allow access without two FA.01:22We're going to run into authentication errors. Make sure those statuses are cleared before you go live. Avoid the double prompt to keep user experience clean. Ensure dual is the only MFA method configured for your targeted users.01:37If you have overlapping requirements, users might get hit with two different MFA prompts, which is definitely not the goal. We have policy alignment as well. Just take a look at your existing dual policies and then try deconditional access targets.01:55You want to make sure your setup is tight enough that everyone can actually satisfy the MFA requirements without hitting a wall. And for cross tenant scenarios, if your organization works across multiple tenants, you're covered, we got you covered.02:10Just make sure your client ID is configured correctly and you should go and you should be good to go. To get your environment ready for the dual external MFA integration, here is a quick breakdown of the prerequisite you'll need to.02:25To take off. On Microsoft intra ID requirements, we have licensing, you will need an active Microsoft intra ID P one or P two subscription or a bundle that includes them. Just make sure those licenses are actually assigned to the users you're planning to secure.02:43Admin access for the initial setup, you'll need a service account that has either global administrator or privileged role administrator permissions. And again guests and cross sending support, we got to cover just if you have guests or cross sending users, just make sure.03:01You configured the dual method in entry ID using the correct client ID and ensure those users object's IDs are set up as username allies in dual. For the dual requirements, subscription well.03:17Good news is that any paid subscription will work for this integration. And about admin roles, just add to or tweak applications in the duo admin panel, so make sure your admin account has the owner, administrator or application manager role.03:33All right, let's go to the fun part. Let's get the configuration rolling. I'm gonna show you, my admin panel. So navigate navigate to your dual admin panel, applications.03:52You can go to applications catalog or add an application. We're going to look for external MFA to find it easier here, click protect and the 1st thing you're gonna need for this integration is to.04:09To click authorize so you're granting dual permissions to read from your Azure or entry ID tenant. So once you authorize here, you'll need to log in with your Microsoft account as an administrator.04:28Consent, except and you will be redirected to your admin panel, and the application will be created. So now here you can modify the application name. Remember that user access is set by default to disable for the applications. So remember to enable it for the.04:45The groups that you're targeting or all users if that makes sense for your integration?05:04And then you don't need to modify much here. So if you want to take a look at the ownership and risk, you can modify here, add users as you need to. Policies the same thing. You have application group policies, application policies and global level policies that you can modify as you need to.05:10To make sure that you have the desired and user experience. In my case I'm gonna allow the self service portal cause I'm going to show you what it looks like when a user is not enrolled and I'm allowing this, the inline enrollment so they can activate dual mobile on their own.05:28And also I'll set normal user normalization too simple. Once you have all these details, you're going to save your application. You're going to use these details on your entry ID, so I'm gonna show you in a minute. But for now, I'm gonna head to the already configured application that I.05:47Actually have because I have already reconfigured this application is the external MFA test name that I have given, and now in my intra ID tenant, go to authentication methods and look for the external MFA option.06:05So, if we go to authentication methods, and then you will see the external MFA option, and once you go there, I'm gonna show you the ones that are the one that I have already configured.06:24But you will have the opportunity to add the information that you need from dual. So you need to grab the name, client ID, discovery endpoint and app ID from your dual application page and paste them right into the intra ID policy.06:41So I've already granted consent, so you'll see the green check mark here, and now you just need to make sure that you enable this method for your targeted users. So you can include specific groups.06:58In my case, I have done it, using dual test, so that's my my group. And also I have I'm excluding other groups. So you can do that or you can enable it for all, for all, but that's pretty much what, what you need to do in this section.07:14Now let's go to conditional access. All right, so in the conditional access, we're going to create a new policy and the same, right? I'm gonna show you the one that I have, but once you create a new policy.07:33I'm gonna click edit so you can see what it looks like once you, go to create. You can give a name that makes sense for you, and then you will have.07:50Users or agents target resources that you can add groups, you can add all applications or certain cloud applications as you need to. You can include or exclude. It's a very flexible policy, so you can do all that.08:07And then, we definitely want to make sure that under access control, you select require MFA. So we go to access controls grant, require multi factor authentication, you select it.08:22And then you will see that your policy will need to be either report only, on or off. So we're gonna keep it on on, but you can do this later on if you need to, and then save any details, right?08:39So, most important parts are the users that we're targeting, the resources, definitely grant MFA required and enable the policy. Alright, so once we have all of this and application has been created.08:54We can test with the user, ok? So it's time to go live, it's time to test. In my case I'm gonna show you I have a group being synchronized from my entry ID tenant.09:12And this, you can see it here is do a test one. It has the user I'm testing with is this one here. So let's log with our test user and see it in action. Remember that we're going to see.09:27What the inline enrollment looks like for this user. So I'm already in an incognito here and we're gonna sign in I have it here.09:42Testing account, and then you need to put your password because I would normally do, and now you're being prompt with the external MFA policy that we configured.10:00Is Cisco duo? Remember that we gave this name is coming from the admin panel in Duo and we paste it in the policy. So we're gonna click here. We're being redirected. Now we have the universal prompt.10:16That is recognizing that this user has not been enrolled. So I'm being prompt to enroll with dual mobile. I'm gonna select dual mobile, but you can choose whatever method that makes sense or that you are allowing your users to.10:33I'm gonna click on have a tablet and I have my phone ready to scan this QR code.10:49All right, took a minute that is ready. And now I've added dual mobile. I'm not adding any other devices for now, and that's it. That was inlane enrollment. Now we're going to.11:06Authenticate. I'm being prompting my cell phone, so I'm gonna approve, and that's it. That's pretty much I can either click this or not.11:22And that's what it looks like for a user that is not enrolled. If a user is already enrolled, they will go straight to the push notification. But that's it. That's all you need to do in order to get your user login entry ID once you have set the policies and configurations in place.11:44Now, let's talk a little bit before finalizing the deployment. Let's look for a minute in our entry ID tenant, that in case, well, 1st of all, in case of emergencies, you need to make sure or you.12:02You might have to, to make sure that there is always at least one Microsoft native authentication method as a backup for your admins and also important to avoid double crowns. There are some recommendations that we have. You can go to.12:19The authentication methods, go to registration campaign, and here you can disable this option or you can enable it and exclude the users that are authenticating with Duo.12:37This is one place that you can look for. You can also go to settings, go to system prefer authentication, and the same thing. You can either disable this or you can inc include or exclude users. In my case, I have excluded my target group.12:53And, what one last recommendation is to go same thing in protection, authentication methods policies, and then in the Microsoft authenticator.13:13You can either disable this or make sure that your target users are being included from the Microsoft Authenticator settings. All right? That's a wrap. So let's bring it home. Let's look at the.13:28Three big wins you're getting with this setup. 1st, seamless native integration. We have officially moved past the days of clunky workarounds by using Microsoft external MFA framework. Duo and entry idea are finally speaking the same language.13:44Making your integration feel completely native and smooth. We also have enhanced security and experience. You're getting the best of both worlds, the heavy duty power of entry disconditional access policies paired with the user friendly magic of dual.14:03With options like dual push baskets, you're keeping security typed while keeping user friction to an absolute minimum. And unified identity protection. At the end of the day, this bridges the gap between your identity provider and your security layer.14:19It ensures that every single login across Microsoft ecosystem is consistent, reliable, and verified. And that's a wrap. Thank you so much for joining me on this cyber capsule.14:35I hope this makes your deployment a whole lot easier. Catch you on the next one. Thanks.14:51
