This document describes how to provision users and groups from Cisco DUO to Cisco Secure Access.
Cisco recommends that you have knowledge of these topics:
This document is not restricted to specific software and hardware versions.
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
Cisco Secure Access supports the provisioning of users and groups from DUO.
This provisioning enables Secure Access to maintain a directory of users authorized to:
Note: This document focuses specifically on the provisioning of users and groups from DUO. The configuration of Entra ID or other Identity Providers (IdP) for ZTA enrollment, VPNaaS authentication, or specific Umbrella Roaming settings is outside the scope of this guide.
In order to begin the provisioning process, you must first configure the directory integration within the Cisco Secure Access dashboard. This step generates the necessary credentials and configuration parameters required to establish a secure connection with Microsoft Entra ID.
Sign in to CSA
Users and Groups
Configuration Management
Integrate Directory
Directory Configuration
DUO TokenOnce you have generated your credentials in the Cisco Secure Access dashboard, you must configure the provisioning settings within your Cisco DUO tenant to enable the synchronization of users and groups.
DUO Log In
DUO Applications
DUO Add App
Add CSA App
API Connect App
DUO Mapping
Provision Group
Note: If users do not get provisioned to Secure Access in the proper format, ensure you configure the Attribute Mapping as stated here.
Users and Groups in CSA
Verity Users in CSA
Verify Group in CSA
DUO Activity Log
DUO Provisioning LogsProvision Users and Groups from Duo
Duo Single Sign-On for Cisco Secure Access
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
11-May-2026
|
Initial Release |