An alternative to self-enrollment is to use Duo’s automatic enrollment features to create users, associate them with devices, then generate a Duo Mobile activation link for each user. The automatic enrollment features are Directory Sync and Import Users.

Directory Sync

Role required: Owner, Administrator, or User Manager.

Since many large organizations already rely on an on-premises Active Directory (AD) server or OpenLDAP Directory, or a cloud-hosted Azure AD directory to manage their users, Duo offers tools to import users and groups from those identity stores into Duo, with the option of automatically sending an enrollment email to every user imported without an attached phone who has a valid email address.

See the Active Directory Sync, OpenLDAP Sync, or Azure AD Sync instructions.

Import Users

Role required: Owner, Administrator, or User Manager.

Duo provides an Import Users feature that can import user information from a properly formatted CSV (comma-separated values) file. The import users feature differs from bulk enrollment in that it allows the admin to supply additional user details (e.g., entries can be created already populated with a phone number and device platform, group memberships, multiple devices, etc.). Also, users imported this way can be managed from the Duo Admin Panel right away.

Although the import users function is primarily intended to add users, you can also use it to update information for existing users and to delete Duo users whose accounts are no longer needed.

Unlike bulk enrollment, the import users tool does not automatically send enrollment emails to users. Follow the Activating Duo Mobile After Enrollment instructions below to send activation links to your imported users.