Knowledge Base Help Center
Duo Administration – Enroll Users
Duo provides several enrollment methods to add users to the system. Self-enrollment allows users to add themselves to Duo and walks them through setting up a device for two-factor authentication. Larger organizations may prefer one of the automatic enrollment options, like synchronizing users from an external Microsoft directory. Administrators can create individual Duo users at any time (manual enrollment).
Overview
Users — and their phones, tablets, or hardware tokens — must be enrolled into Duo before they can start using the system. Enrolling may include the optional step of activating the user for Duo Mobile, which allows your users to generate passcodes from the Duo Mobile app or use one-tap authentication with Duo Push. In order to use Duo Push, users will need to install the Duo Mobile app on their devices and then add their Duo account to the app. This process will only take the user a few minutes.
Duo administrator accounts are only used to log on to the Admin Panel. They can’t be used to access devices or applications using Duo two-factor authentication. Be sure to also enroll your Duo admins as users if they need to log on to Duo protected services.
Users (identified by their usernames) are shared between applications, so a user only needs to complete enrollment and activation in Duo once to gain access to multiple applications. User access can be restricted to specific applications through permitted groups for individual applications.
An enrolled user is an end user who accesses Duo-protected services or applications, who exists in Duo as a user with an associated two-factor authentication method. A partially-enrolled user is one who exists in Duo with a username but has no two-factor authentication methods. These users still need to complete device enrollment and activation to fully use Duo.
There are three methods of user enrollment: automatic enrollment, self-enrollment, and manual enrollment. The automatic enrollment and self-enrollment methods save you the time and effort of manually adding your Duo users.
- Automatic enrollment: Admins can add a group of users and then send them activation links that the user follows to complete their enrollment. Users are created in Duo immediately.
- Active Directory sync: For customers who already rely on an Active Directory (AD) domain. Learn how to use AD sync.
- OpenLDAP sync: For customers who use an OpenLDAP directory for authentication. Learn how to use OpenLDAP sync.
- Azure AD sync: For customers using an Azure Active Directory (AAD) domain as their user identity store. Learn how to use Azure sync.
- Import users: Admin can create detailed entries for each user with a simple CSV file. See more information about importing users.
- Self-enrollment: Users add themselves to Duo through a browser interface and step through the installation and configuration of Duo Mobile. Self-enrollment takes less than two minutes for most users.
- Inline self-enrollment: Features an interactive setup process that is seamlessly integrated with the user’s next login. Inline self-enrollment is available for applications featuring browser-based logins as well as Duo Unix.
- Bulk self-enrollment: Creates new users in Duo without any 2FA devices and sends an enrollment link to the users via email in a single operation.
- Manual enrollment: Admins manually add individual users and send activation links.
Duo Beyond and Duo Access Plan Users: Global Policy settings affect access to the enrollment portal used by bulk self-enrollment. Do not apply any global restrictions that could prevent user enrollment. For example, if you configure the User Location policy setting to deny access to a country, then the policy will also block any of your users who attempt to enroll in Duo from that country via a bulk enrollment link.
