In short: The Duo Admin Panel is the web console where Cisco Duo administrators protect applications, manage users, groups and devices, set global, application and group policies, assign admin roles, issue bypass codes and review logs and reports. Admins sign in at admin.duosecurity.com and must use two-factor authentication. Applications use Duo's Universal Prompt.
What is the Duo Admin Panel?
The Duo Admin Panel is the cloud console for your Duo account. There is nothing to install: administrators sign in at admin.duosecurity.com with their admin email, then a password or single sign-on through your identity provider, and always a second factor. Only Owner administrators can restrict which second-factor methods admins may use, and ten failed login attempts lock the admin account until it is unlocked.
From the Admin Panel you can see every protected application, every user and every authentication. It is also where you reach Cisco Identity Intelligence on Advantage and Premier.
What admins do there
- Protect applications: add an application from Duo's catalogue, then copy its Client ID, Client secret and API hostname into the system you are protecting. (Older guides call the first two the integration key and secret key.)
- Manage users and groups: create users, import them through directory sync from Active Directory, Entra ID or Google, and organise them into groups for policy.
- Manage devices: phones, hardware tokens, security keys and endpoints, including reactivating Duo Mobile when someone gets a new phone.
- Issue bypass codes: temporary codes for a user who has lost their device, ideally short-lived and single-use.
- Set policies: decide who must use MFA, which methods are allowed, and what devices may connect.
- Configure SSO: authentication sources, routing rules and the Duo Central portal for Duo Single Sign-On.
- Review logs and reports: authentication, administrator and telephony logs, plus reports on users, devices and policy impact.
Policies: global, application and group
Policies are where Duo does its real work. They stack in layers, and the most specific one wins:
| Policy level | Applies to | Precedence |
|---|---|---|
| Application-group policy | A specific group using a specific application | Highest |
| Application policy | Everyone using one application | High |
| User-group policy | A group across all applications | Medium |
| Global policy | Everyone and every application (cannot be deleted) | Lowest |
Common settings include the new user policy (what happens to someone not yet enrolled), allowed authentication methods, remembered devices, Trusted Endpoints, Duo Desktop requirements, operating system and browser rules, user location and risk-based authentication. What you can set depends on your edition: Duo Free controls little beyond the new user policy, while Advantage adds location, operating system, device health and risk-based options. Our usual approach is a sensible global policy, a stricter policy for admin and finance applications, and as few exceptions as possible.
Administrator roles
Not every admin needs full control. Duo's built-in roles let you give people only what they need:
| Role | Typical use |
|---|---|
| Owner | Full control, including managing other admins, API applications and plan changes |
| Administrator | Day-to-day management of users, devices, apps, policies and settings, but not billing or other admins |
| Application Manager | Adding and managing applications and SSO authentication sources, without creating or editing policies |
| User Manager | Users, attributes, phones, tokens, bypass codes and directory sync |
| Help Desk | Routine user support: phones, tokens, bypass codes and unlocking accounts, without bulk changes or full syncs |
| Security Analyst | Processing risk events, locking out users and viewing all logs and reports |
| Billing | Billing information and purchases only |
| Read-only | Viewing users, devices, applications and all reports without making changes |
| Account Switcher | Switching between subaccounts, for organisations with several Duo accounts |
From Duo Essentials you can also build custom roles with granular permissions, using a standard role as a template. On Duo Free there is no role separation, so every admin effectively has Owner rights. Giving your service desk the Help Desk role, rather than full admin rights, is one of the easiest wins in any Duo account.
The Universal Prompt
The Universal Prompt is the Duo login screen users see. Instead of appearing inside the application's own page (an iframe), the application redirects the user to a page hosted by Duo and back again once they have authenticated. It supports passkeys and platform authenticators such as Windows Hello and Touch ID, WebAuthn security keys and Verified Duo Push, which the traditional prompt cannot enforce. Duo stopped supporting the traditional Duo Prompt for most applications on 30 March 2024, with a few extended-support exceptions that have since ended.
Two things to check in an older account:
- The Universal Prompt Progress report (under Reports) shows each application's status, such as update required, ready to activate or activation complete. Updating the integration, for example to a newer Windows Logon or Authentication Proxy version, usually fixes it.
- U2F-only security keys: the Universal Prompt drops U2F, so users with older keys that do not support WebAuthn need to enrol a newer key.
We can audit your account and bring every integration up to date.
Self-service, directory sync, AI Assistant and APIs
- Self-service portal: enabled per application, it lets users add, rename and remove their own devices, which cuts help desk calls when phones change.
- Directory sync: keeps users and groups in step with Active Directory, Entra ID or Google so joiners and leavers flow through automatically.
- Cisco AI Assistant for Duo: available from Essentials, it answers plain-English questions, uses logs and device information to summarise why a user was denied access, and finds configuration answers in Duo's documentation. It respects each admin's role, cannot make changes, and its answers should be checked.
- APIs: the Admin API and other Duo APIs let you automate user management and send logs to your SIEM.
New to Duo? Our Cisco Duo setup guide walks through the order we configure these in.
Let us manage the Admin Panel for you
The Admin Panel is easy to start with and easy to let drift: too many bypass codes, policies with forgotten exceptions, integrations on old versions, and admins who left years ago. We can run it for you as a managed service, covering user changes and help desk escalations, policy reviews, version updates and regular reporting, or review your account once and hand back a tidy configuration. Contact us to talk about Duo management.
How Forever Systems supplies and supports Cisco Duo
We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.
- Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
- Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
- Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
- Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
- Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Duo quote, trial or roll-out plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
How do I log in to the Duo Admin Panel?
Go to admin.duosecurity.com, enter your administrator email, then your admin password or your organisation's SSO, and complete two-factor authentication. Duo requires MFA for every administrator.
What is the Duo Universal Prompt?
It is the current Duo login screen, delivered as a redirect to a Duo-hosted page rather than inside the application's page. It supports passkeys, WebAuthn security keys and Verified Duo Push. Duo stopped supporting the older traditional prompt for most applications on 30 March 2024.
What is the order of Duo policies?
Application-group policies take precedence, then application policies, then user-group policies, then the global policy, which applies to everyone and cannot be deleted.
What are the Duo integration key and secret key now called?
Duo now calls them the Client ID and Client secret. You copy them, with the API hostname, from the application's page in the Admin Panel into the system you are protecting.
Can I give our help desk limited access to Duo?
Yes. The Help Desk role lets staff handle routine user support, such as phones, tokens, bypass codes and unlocking accounts, without changing policies or applications. Custom roles are available from Duo Essentials.
What happens if a Duo admin is locked out?
Ten failed login attempts lock the admin account. It can be unlocked straight away through a link Duo emails to the admin, by an Owner resetting the failure count, or automatically after 24 hours.