Achieve Duo Outcome: Security-First IAM

Okay, hello, everyone, and good morning, good afternoon, and good night to all who have joined. My name is Amika Shenoy and I'm the customer experience programs lead here for.00:11For Duo within our Cisco customer success team. I'll be serving as the host of today's duo security 1st identity and access management webinar. So thank you all so much for joining us we do have some really great content lined up for you today. So to get started, I'd like to introduce our duo specialists who will be presenting and assisting during today's webinar.00:20All of our presenters and panelists today are seasoned zero trust technical customer success specialist here at Cisco. And our main presenters today will be Patty and Sam. Our panelists will be, that you'll be work, will be working to answer your questions, will be Abid, Akanksha, John, and Ryan.00:40Let's move to the next slide. Alright, so speaking of asking questions during today's session, you can ask questions at any time. In fact, we very highly encourage it. All we ask is that you type your question into the Q and A panel, which you can locate by clicking the three dots on the bottom right.00:58Right hand side of your screen and selecting the Q and A option. Please remember to select all panelists from the dropdown, list, click send, and our online panelists will respond to your question as soon as possible.01:17Alright, with that I'm gonna go ahead and pass it over to Patty to jump into our specific agenda and get us started. Thank you. Thanks Anika. Welcome everyone. Today we're gonna start with an overview to set the stage for today's discussion.01:32Next, we will explore the concept of security 1st identity and access management, otherwise known as IAM, focusing on how it strengthens protection by prioritizing security without compromising user experience. We will then dive into Duo directory, highlighting its capabilities such as.01:47Enabling true passwordless authentication, removing passwords from enrollment and fallback workflows, and integrating with external cloud based or on prem directories. Following that we will touch on the Cisco AI assistant for Duo, which leverages AI to streamline setup.02:07Investigation and troubleshooting by aggregating authentication logs, admin activity, and device data. This provides reliable context information quickly. We will then provide a demonstration of using the duo admin panel for typical IAM related tasks, and finally, we.02:26We'll open the floor for your questions to clarify any points and discuss how these solutions can be applied in your environments.02:46When we talk about what it means to be security 1st at duo, we are fundamentally challenging the traditional industry model. For too long, security has been treated as an expensive add on, something you have to pay extra for as your needs evolve.02:55For us, being security 1st means making robust protection and integrated standard, not an afterthought. Attackers have become extremely good at stealing credentials. They NO longer need to hack in. They simply log in.03:11They're using AI to accelerate the speed and scale of their attacks through automation. And in 2024 alone, 60 % of breaches started with identity and over 80 % leveraged stolen credentials.03:28As an example, attackers could simply copy your sign in page and host their own fake version of it to capture the usernames and passwords of your users.03:48And AI has made it easier than ever for bad actors to execute this kind of phishing attack. And if that wasn't bad enough, attackers now expect to run into MFA MFA, and they know how to beat it. We've seen a rise in techniques to bypass what once was a significant barrier.03:57Getting second factor authentication.04:17So like it or not, traditional IAM vendors have failed to keep up with this rising on slot of attacks. Your choices in the market today are either insecure, too costly or too complex to implement properly. We need a new path forward.04:22I want you to meet the new duo. Duo identity and access management or Duo IAM for short. We're a full identity and access management solution with the goal of redefining and restoring trust and identity.04:39We do that with a security 1st approach to IAM where identity is secure by default. One of the key features of that is end to end phishing resistance, where you get to defend against the most advanced identity threats. We have unified identity intelligence where you can continuously verify.04:58Across your entire environment and we always provide a world class user experience. We have everything you need to secure and manage identities from day one built from the ground up to sort identity attacks.05:17Finally, identity that puts security 1st. Duo is simple to use IAM provides a user directory with life cycle management, a robust single sign on solution, and advanced security, like phishing resistant MFA.05:35Passwordless and device trust, all by default. That's security 1st. When many people think of directories, they think of passwords. If your organization isn't yet ready for passwordless, either operationally or psychologically, we now allow.05:52For users to create a password directly in Duo for use with our phishing resistant MFA.06:12Duo can now be your source of truth, enabling you to cut ties with your legacy directories such as Active Directory and minimize your on premise footprint. You NO longer need to have an on prem infrastructure in the loop for authentication.06:18If all you want to do is check a password. This also sets the stage for later shifting to true passwordless. Users enroll a duo password and a passwordless cable authentication device for use with MFA. When you're ready.06:34Modify your duo policies to only allow passwordless authentication. Where else might you have dependencies on legacy directories? How about for retrieving user attributes to be used for single sign on? You can now define custom user attributes in duo.06:51And create them directly in Duo or sync them in from your existing directories. And what can you do now that you have all of those identi those attributes directly in duo? You can use Duo as your source of truth, not just for authentication, but also for user provisioning by leveraging SCIM to automatically create.07:09Create, update, and delete users in your connected applications.07:29Let's look at how we've leveled up enrollment to support password based MFA, as well as true passwordless. Through the introduction of a new type of policy, the enrollment policy. When we set out to introduce support for duo passwords, we decided to overhaul duo.07:38Enrollment as a whole. To do this, we separated enrollment from authentication. This gives you the freedom to control enrollment of new users and devices without impacting the way your users access their applications today. Do you want to require new users to enroll passwordless capable factors?07:58While still allowing existing users to authenticate with password based MFA, our default global global enrollment policy is designed to enable exactly this scenario. You can continue with MFA until you're ready to start going passwordless.08:18Do you have users in a call center who only need access to a few of your SaaS applications? These users typically don't have access to phones to leverage Duo mobile, so create a user group enrollment policy to require them to set a duo password and allow them to enroll Duo desktop as an authenticator.08:34Or better yet, only allow them to enroll pass keys. Think security keys, touch ID, windows, hello, and go to passwordless from day one. To compliment our new enrollment policy, we have a range of options for you to enroll your users and for them to enroll them.08:53As ever, you can manually create users in duo, but now you can sync users in from an even wider range of range of external directories. Pull in users from Active Directory, enter ID, Google Workspace, Okta or an open LDAP directory.09:14Or use our admin API to build your own user sync for your next gen blockchain based distributed directory. Automatically email users individualized links to our cloud enrollment portal where they can enroll duo passwords, traditional MFA factors, and passwordless capable authenticators.09:32Our enrollment portal also now supports two new enrollment methods. Enrollment codes and enrollment via an active directory or SAML authentication source. You might have a user calling into the help desk for assistance with enrollment. Strongly verify their identity and then provide them a unique code to initiate enrollment.09:51What if you're migrating from an existing identity provider or rolling out MFA for the 1st time? Direct users to your unique enrollment portal URL and allow them to enroll after verifying their active Directory credentials.10:11If you're looking for a convenient way to en for users to enroll as they access their 1st Duo protected application, Duo allows you to do so in a secure manner by enforcing a time limit on enrollment. Users who have not enrolled within the set time period will be locked out.10:28Ensuring that user enrollment is a limited and secured action. Finally, for those situations or users where all else fails, you can quickly and easily enroll users manually. Many of you know Duo from our early days when MFA was still getting off the.10:44Ground. All these years later, we are still adding MFA into your workflows while layering even greater security controls into your environment. Every organization manages a complex array of authentication models across their application landscape.11:04This probably includes on prem apps that still use radius or LDAP, protecting windows login logins and RDP access and SAS apps that use SAML and OIDC. With legacy and API driven integrations, Duo is providing 2nd factor for traditional MFA.11:21But for single sign on applications, where Duo owns the entire authentication flow, Duo can now offer you even more flexibility than before through the power of Duo directory. Single sign on is an authentication process that allows a user to access multiple applications.11:40User services with a single set of login credentials. As a result, SSO allows for seamless access to approved applications without the user being prompted to log into each one. And with hundreds of out of the box SSO integrations, Duo makes it quick and easy to set up apps.12:00Plus, with generic SAML two two point oh and OIDC integrations, adding custom apps takes just seconds. Building on our security 1st approach, let's look at how we're evolving access.12:19Traditionally, single sign on has been limited to cookie based sessions within a web browser. However, in today's diverse IT environment, that's NO longer enough. Duo is changing the game by extending those SSO capabilities beyond the browser to include your operating systems and native applications.12:34We call this feature duo passport. It's designed to provide a consistent, secure, and frictionless sign on experience across your entire ecosystem, ensuring that your security follows the user wherever they work. Duo Passport makes the makes user authentication invisible.12:54And reduces authentication fatigue by verifying user identity and device trust upon login.13:13Once authenticated, Duo passport continuously ensures secure access using adaptive risk based policies without reprompting users. Passport ensures that users authenticate once and get on with their day.13:20It's security that works smarter, not harder, whether they're jumping between websites VPNs or native applications. Now that we've streamlined the login process for users, let's talk about device stress.13:37Duo device trust keeps hybrid workforces secure by verifying every device with NO agents needed. Spot risks enforce custom policies and lock down your network with built in security with that integrates into your workflows and applications.13:56If it's not trusted, it's not getting in. Duo's device trust turns each connection into a checkpoint. Verifying device health, enforcing security policies, and ensuring only trusted devices gain access.14:13It works quietly in the background securing your organization while keeping productivity at full speed. If you can't see it, you can't secure it. Visibility is the 1st step towards zero trust. Duo's agentless solution lets you monitor every device on your network enforcing health checks, which with every login at time.14:30Duo provides real time visibility into managed, unmanaged, and BYOD devices. Spotting vulnerabilities like outdated OS versions or jailbroken are rooted devices before they can be exploited. Let's.14:51Review our diagram for duo trusted endpoints off flow.15:101st, Duo issues API calls to your managed endpoint services from our cloud infrastructure. This updates your device cache in your Duo tenant with the list of approved managed devices from your MDM. Alternatively, if you don't have an MDM, you can update your Duo tenant with your.15:15Deviceless without an MDM connection.15:34Second, a user logs into a browser based duo protected application that shows the inline duo prompt. On the 3rd step, a successful login to the web application redirects the client to duo. Duo's cloud service applies the trusted endpoints policy settings to the access attempt.15:38On the 4th step, the Duo prompt checks for either Duo desktop on the computer, a device trusts connector in a browser or duo mobile on the user's access device. Duo will then verify whether the endpoint matches a device ID in your trusted endpoint cache.15:59If there is a match, Duo reports the endpoint as trusted. At this point, the authentication would be allowed. Lastly, if Duo desktop or duo mobile isn't present or the device ID doesn't match, we block access from that device.16:17To effectively mitigate social engineering, you need to ensure that only verified, healthy devices can access your applications. That's where duo trusted endpoints comes in. We provide a comprehensive approach to device security, featuring the industry's widest OS coverage, including Windows, Mac OS.16:37Linux, Android, iOS, and Chrome OS.16:57With a broad set of integration methods such as MDM, API, and partnerships like lead with leaders like CrowdStrike, we can offer both client and clientless support to fit your specific environment.17:02Okay. We know you have complex environments to manage. Your needs might be different depending on the groups of users accessing your applications. We've built Duo IAM with that in mind. If you're ready to implement Duo as your primary IDP, we are ready.17:18Duo can act as an identity broker for your existing IAM solutions, allowing you to integrate all the best duo features like passwordless and device trust into your authentication workflows. If you don't want to put us in as your primary IDP, we can run.17:39Side by side with your existing IDP for a subset of your user population.17:59Whether that's contractors, vendors, partners or other 3rd parties who might not belong in your main directory. Duo's customizable deployment offers maximum flexibility with this. Okay, lastly, let's discuss Duo's AI.18:04My assistant.18:23We're making life even easier for our admins with the new Duo AI assistant for identity. It's a built in AI assistant in the duo admin console that can help you simplify configuration if you're new to Duo. It can also help you set more effective policy for controlling access.18:28Or it can accelerate help desk tasks like figuring out why a particular user is struggling to log in without having to click through and find the information in the admin console. We're excited excited to speed up your troubleshooting and discovery workflows with the new Duo AI assistant.18:46Now, my colleague Sam Collinsworth will do a brief demo of some of the components we've discussed discussed today. Audie everyone. Give me a second there.19:08My name is Samuel Cownsworth. I am a technical CSS with Duo as well, and I'm gonna walk you all through some of the concepts that Patty just covered. Give a moment to get my screen share up.19:23Hopefully everyone can see that. So go ahead and get logged into the admin panel. Everyone, everyone should be familiar with this concept if you're a duo subscriber. Let's go ahead and get logged in there Awesome. So today we're gonna go over a couple of concepts that.19:40They just just presented on, but mainly we're gonna create a dedicated duo group for the use of routing.20:00Both with authentication and policy, and then we're gonna add a manually created 3rd party user to that group. And this is gonna be a user that doesn't exist in an external directory but only exists in duo. And after that, we're gonna briefly show off the custom enrollment policy aspect to show how you can route different enrollment.20:07Behaviors for different groups of users, and then we'll go over very briefly our SSO routing rules so we can show how different directories can be used for satisfying credentials from for different users.20:27And then finally, we'll just, I'll show you how it looks when these different users log in. So to begin, let's go ahead and create that group. So you go to users and then groups, you should see your list of established groups here. Let me move this little screen share guy out of the way.20:39We'll go ahead and add it to roof. And for clarity's sake, we'll call this 3rd party users and then click in, there we go.20:58Fantastic. Leave that all at the default, and then we gotta create a user to put in there right, let's go ahead and name this user duo directory once again for clarity's sake.21:14And then he'll need a domain format for logging into Duo SSO based application, so we'll go ahead and cover that there. An email address is always important. This isn't for the use of authentication, but for sending enrollment emails. So if you're doing enrollment via email, you'll want to make sure you always populate your email address field.21:37Let's go ahead and pop him in that group, put them in right here and then we're gonna put him in 3rd party users, so with our duo directory user in that group.22:01And that group created, we'll go ahead and assign behaviors. So we'll see here, and this is this is somewhat new. So as always we have our policies up here which affect authentication, but now we have user enrollment and account management, which this affects the initial enrollment experience for users and.22:19Just as with our regular policies, you can create multiple of these and associate these with different groups. So we'll go ahead and demonstrate that now. Same concept as our normal policies. We have a global policy that operates as our catch all, and you'll see here there's only a couple sections. One duo directory password should be somewhat intuitive but.22:40This is a password for use if Duo directory is the IDP in use with Duo SSL for for an application. And then very recently we do have new password complexity and, and configuration policy.23:00After that, authenticators, this is mainly what you'd expect to see when a user's enrolling with duo. Right here. This is what, this is to be absolutely clear, this is not what users are allowed to use while logging in because that would still, that would still be the responsibility of our standard authentication policy. This would be what user.23:16Is are allowed to enroll on their initial.23:36Under their initial enrollment. So you'll see here that we have platform, platform authenticator, roaming authenticator, dual mobile, and then pass key covers a bit more than just roaming and and and platform nowadays. But so this is our global policy, and for the purpose.23:39Of since this new 3rd party user will be coming from Duo directory exclusively, we'll have them set a password during inline enrollment. And there, we'll just go and click require password indicators. And so we'll go ahead and leave that default, you know, we wanna encourage use of more secure authent.23:58Indicators so we're gonna leave phone number off. Identity verification is a subject or another presentation, very exciting new feature that we have with duo. You see here we have our 3rd party enrollment policy that we just need to associate that with our group.24:18And we will apply user group policy right here, 3rd party, and then 3rd party users, simple as that. But now when a user who is in that group authentic or enrolls for the 1st time, they will be required to set a password.24:37Alright, after that, let's go ahead and let's take a brief look at SSO routing rules cause this is gonna be very important. And I I think this is very cool. We go to applications and then SSO settings. So, and many maybe familiar with this and.24:55Many not, but we allow for the use of like credential verification. We allow.25:15You to add as many IDPs or off sources as you'd like. And historically we you could only route to one, you can only keep one enabled, and you'll see here that I have a, I have a active active directory connection here, which we'll use in our demonstration, but so this new feature routing rules allow.25:22Allows us to dynamically route users to different off sources or IDPs.25:42So you see up here our default rule similar to policies, this is our catch all rule. If we don't have anything else here or the conditions of of whatever else we have here aren't met during a user's authentication, they'll be routed to our default rule, which uses the authentication source Active directory.25:46So that should be pretty evident, but let's go ahead and add a routing rule. And we'll go ahead and make this our contractor. So maybe these contractors that I'm adding or this, this 3rd party user, we don't want him in AD or we don't want to have to add him in entro and pay for a license, so.26:03We are just going to add them to Duo and utilize these routing rules to make sure that that isn't is is enough to log into an application.26:22We'll go ahead and preemptively mark that to enable. And so you see here we have, we have four different pieces of criteria for routing to different IDPs. And for the purpose of this presentation, we will go ahead and select our group. So anybody who's in 3rd party users.26:30Will be routed to a different directory, which for here we will select duo directory because they just live in duo. All righty here. And then also very nice. I I find a lot of a lot of my static customers find this pretty exciting, but our routing rule calculator.26:47Here.27:06This is really awesome, and we will go ahead and take a look. Duo directory@contractor.com, but we can just go ahead and take a look if Duo directory logs into.27:08To a central or is he gonna be routed through? We can see here that since he matches the condition of the rule, the calculator claims that he's gonna be routed through to a directory. Let's see that in real time. So if I go ahead and open up, actually you know what? We can just.27:27Let's go ahead and open up a, another browser, and we'll go to this is my Duo central instance which is linked to duo SSO. So for the purpose here, let's 1st look at something we should be pretty familiar with a user connected to an external directory. So this, this user comes.27:46From Active directory.28:05Yeah. We can see that it comes up here, it wants a password. This password connects back to my local active directory instance, and she's offered the op.28:09Which I will I won't go ahead and bother going through this whole thing with the standard user, but since you saw that she had used a password, and that's for Active directory. Well, now if we log in with our.28:31Yeah hold on, we have to get logged out here. Now if we log in with our duo directory user, we'll see a bit of different behavior. And this is all routed on the basis of that, of that group that we created.28:48Go. I gotcha got our user here, but we can see that he was routed to through a different directory. Probably he needs a device since I didn't send him a enrollment email, he doesn't have a device to log in with and he doesn't have a password. Let's just go ahead and give him a device really quick.29:23I will see that again. And now he still does not have a password.29:46Do a directory@contractor.com is still my username we use the pass key that I connected and he's logged in Passwordless with a completely different authentication routing than with the 1st user with Active directory. Hey.30:03And I get a lot of questions about this frequently. You can see this at authentication logs and you can, you can see the routing, so let's go ahead and take a look at that very briefly.30:22We can see my AD connected user here logging in, and then you can see my duo directory contractor here logging me in.30:39Awesome. Just to briefly recap and conclude, we on a instance of Duo SSO that was already connected to Active directory, we were able to use SSO routing rules to make a user who is not connected to any external directory.30:56We still be able to log into an to application that's connected to our SSO instance. So through connecting to Duo SSO, we are able to connect a myriad of IDPs and utilize SSO routing rules to route users wherever and whenever they may need to go to a different resource.31:16I will kick you back to Amika for closing and questions. Thank you everyone. Wonderful. Thank you so much for that fantastic presentation on Duo Security 1st I AM Patty and Sam. So let's take some time to review a few frequently asked questions. And folks, if you have any questions and haven't yet asked.31:36Posted in the Q and A box, please do feel free to drop it in and that way we can make sure that one of our panelists is able to provide some insights.31:56Alright, so our 1st question, if we adopt a security 1st posture with Duo, how do we ensure our employees aren't overwhelmed by constant authentication prompts which might lead to MFA fatigue? I can take that.32:05So for, for the security 1st posture, the security 1st approach does not mean that security's always. It means you know at the at the expense of productivity, that's not the the design. So with Cisco duo.32:24We utilize adaptive authentication. So instead of prompting these every time for every login to analyze this context, user's location, the device health and behavior patterns.32:42If the login attempt is from an unknown trusted device with a familiar location, the system will allow access without any additional prompt. We only trigger the MFA in this situations.32:58When there is a change in risk such as an unknown IP address or out of date device, any of the security on the device as well as the location, and this should ensures the security is invisible when things.33:13Are normal and robust and and the risk risk is detected otherwise duo changes the way it it prompts you based on those things. So, that's that. Thank you.33:32Wonderful. Thank you, Ebit. Next for organizations currently running Okta or Microsoft intra ID as their primary IDP, what does a realistic migration path to Duo IAM actually look like? Is it typically a hard cut over, a phase rollout or can the two truly run side by.33:49Decide Indefinitely anyone?34:09We can skip it if need be. Let's move to the next question. In today's hybrid work environment, where the traditional network perimeter has effectively dissolved many organizations are shifting towards a security 1st identity.34:34Strategy.34:52How does Cisco do as approach to IAM help organizations balance the need for rigorous zero trust authentication with the necessity of main maintaining a seamless and productive user experience for employees? Thanks Amika, I can take that one. Hello everyone. So the reality.34:52See today is that the network perimeter is NO longer a physical office wall, right? It is the identity of the user and the health of the device they are using. So at at Duo Cisco we believe that security 1st does not have to mean user friction. In fact, when implemented correctly a.35:12Strong security posture allows actually improves the user experience. So we achieved this balance through three key pillars. Adaptive authentication, device trust, and the shift to passwordless. Now ultimately our goal is to move security out of the way of the user's workflow while ensuring.35:32That the organization remains protected against modern identity based threats. We aren't just securing access. We are building a foundation for a more productive hybrid workforce.35:52Wonderful. Thank you, Akanka. Our next question, we have employees but also a lot of vendors and contractors. Can do we manage all of them or do we need a separate solution for external users?36:07I'll take that one Amika. So as Sam kind of touched on during his demo, Duo does manage all user types and we do it in a single platform. So your employees can stay synced with your existing directory such as AD, intra. Well, vendors contractors, and partners can be managed separately in Duo directory like Sam had demoed.36:22This separation separation means external users don't need accounts in your corporate AD or intra, so you're reducing your attack surface there and then you're keeping your directory organized and simplifying the off boarding. There's NO need to search for disable accounts in your core identity infrastructure.36:42And all users still benefit from the same strong duo security that's managed independently without requiring a separate product. Great, thank you John. Appreciate it.36:59Our next question, we have a significant number of on premises applications that aren't cloud ready and don't support modern protocols. How can we support a security 1st IAM strategy to these systems without a complex infrastructure overhaul? This is a good question.37:15Thanks Amika I can take that as well. So yeah, this is a very common scenario, so you don't need to modernize applications themselves to secure them. So some of them will remain legacy for a while, until they improve their technology or coding to.37:34To reflect that for cloud ready. We can use in this case we would use dual authentication proxy to bridge that gap. So it acts as the lightweight secure connector that sits in your environment and communicates with your existing on prem infrastructure such as your VPNs radius servers.37:53Of that directories and by routing these legacy authentication requests through.38:13The dual proxy, you can instantly layer in MFA device health checks and so on. So this allows you to maintain a consistent security policy across both modern cloud apps and your legacy on prem systems all from the same metho.38:20Thank you. Thank you, Evan. Alright, we're gonna move into some questions in the Q and A box. So the 1st question is, does Duo have a feature where a user can unlock him or herself?38:42And I think already answered that, yeah. And I have some follow up questions on that so do you want to go ahead and elaborate out loud in case folks haven't seen the answer in the Q and A? Sure. So yeah, so Duo does have a self service feature.39:01That allows users to manage their own devices and authentication methods, right? Which includes capabilities which are similar to unlocking or reactivating themselves and this feature is called self service portal, and when enabled for an application, users see additional links in the duo.39:20Prompt during authentication such as, you know, add a new device or my settings and devices, which essentially allows them to modify their, auth devices without needing.39:41To contact their IT support. And I have also attached the documentation for the SSP. Perfect. Thank you Puncha.39:54Our next question is Duo I M available for all the tenants? I'll take that long weekend. Yeah, so duo directory AK duo AI duo.40:10What IAM, does work with all directory or all tenants, all versions of duo. The caveat would be some of the features like passport, are only available on the two highest tiers advantage.40:29And forget what's the other one? Beyond? Not beyond anymore. Premiere. That's right. Advantage and premier. Thank you Sam. I wasn't a fan of beyond, though John I I'm glad you brought that up. Awesome. And real quick Akansha I think there was a request a request for the self service link.40:46Needs to be shared in the chat, so if you haven't already done so, if you can share it out, I think that would be helpful. Thank you. I think you may have already done it, but I can't see it unfortunately. Okay, that sounds good. We'll do one more question before we go ahead and wrap.41:06App. So there's a question elaborate on dual passport and the certificate and the use of TPM 2.0. Does passport work with similar features as TPM, Apple security e clave? Samsung Known Vault and Google key store, et cetera.41:19I can jump in on that one too because so I was trying to respond to that one in chat. I will also grabbing the documentation for that. So duo Passport does work with those. Actually duo Passport requires that you have a TPM two point oh or secure enclave on the Apple Mac device.41:37Wonderful. Thank you, John. All right, we'll go ahead and wrap up the Q and A section here. Patty, if we can move to the next slide. Thank you. So folks, as we wrap up today's presentation on duo security 1st, I am, I wanted to note a few important details. The 1st.41:591st is that we will be sending out a recording of today's session for future review. And additionally, any resources that we've pinged out during today's session in the chat will be included in the follow up email, so if you missed those links, you'll be able to access them and review them when you received the post webinar email. Also, please note that if you'd like to discuss your duo deployment fri.42:19Further with a technical customer success specialist, we'll be including a hand raiser link for you to request a free one on one engagement.42:39So please feel free to submit a request via this form in order to chat with the technical specialist to answer any questions you have or review your current duo deployment and receive best practice recommendations to ensure a strong zero zero trust posture within your your application's security environment.42:47So we'll move to the next slide. And with that, we appreciate everyone joining today's duo security 1st IAM webinar. We look forward to seeing you in the next one. Thank you.43:06