In short: Duo Directory is a cloud-based user directory in Cisco Duo that lets Duo act as your identity provider. Users can be created in Duo or synced from Active Directory, Entra ID, Google or a SCIM source, and provisioned out to Microsoft 365 and Google. It supports SAML, OIDC and OAuth sign-in and is included from Duo Essentials.
What is Duo Directory?
Duo Directory is the identity store inside Cisco Duo. It holds user accounts, groups and attributes, and it is what lets Duo Single Sign-On work as a complete identity provider rather than an MFA add-on to somebody else's.
That matters for two kinds of organisation. If you have no on-premises Active Directory, perhaps because you are cloud-first or have grown up on Google Workspace, Duo Directory gives you somewhere to keep identities that is not tied to one application suite. If you have several directories after a merger or a messy history, Duo Directory can bring their users together behind one sign-in and one set of policies.
Duo Directory is included in Duo Essentials, Duo Advantage and Duo Premier.
How users get into Duo Directory
You can mix methods, so long as each user has one clear source.
| Method | What it does |
|---|---|
| Hosted in Duo | Create users directly in the Duo Admin Panel, with no other identity store needed |
| Active Directory sync | Imports users and groups from on-premises AD through the Duo Authentication Proxy |
| Microsoft Entra ID sync | Imports users and groups from Entra ID, cloud to cloud |
| Google sync | Imports users from Google Workspace |
| OpenLDAP sync | Imports users from an OpenLDAP directory |
| Inbound SCIM 2.0 | Receives users and groups from Okta or another SCIM-compliant directory |
New users can then enrol through their previous identity provider, an enrolment code or an enrolment email. Synced users stay managed in their source directory, so joiners, movers and leavers flow through automatically.
Passwords and enrolment controls
When Duo Directory holds the password, Duo gives you the controls you would expect of an identity provider:
- Breached password checking, so users cannot set a password known to be exposed
- Proactive password reset and forced password change when you suspect a compromise
- Enrolment policies that set which authenticators users may register and the password rules they must meet
- Passwordless-only sign-in, by switching off the fallback to a password once users have passkeys or security keys
That last option is the point many organisations are aiming for: a directory where most users never type a password at all. See Duo Passwordless for the methods.
Provisioning out to Microsoft 365 and Google
Duo Directory can also push accounts out. Outbound SCIM 2.0 provisioning creates and updates user accounts in Microsoft 365, Google and other applications that accept SCIM, so a new starter added in one place gets their mailbox and apps without a second manual step, and a leaver is removed everywhere.
If you want to use Duo SSO or passwordless with Microsoft 365 and do not have on-premises AD, Duo's documentation says you must set up automated provisioning to Microsoft 365 for all users, so that each user carries the attribute Microsoft needs to match the federated login. We set this up as part of a Microsoft 365 integration. For Google, see Duo for Google Workspace.
Protocols and what you can protect
| Use | Protocols |
|---|---|
| Single sign-on | SAML, OIDC and OAuth |
| MFA-only integrations | RADIUS, LDAP, the Duo APIs and web application integrations |
| Provisioning | SCIM 2.0 inbound and outbound, plus directory sync |
In practice that covers SaaS applications through Duo SSO, VPNs and firewalls through SAML or the Authentication Proxy, and Windows logon through the Duo Windows client.
Who Duo Directory suits, and how we help
Duo Directory is a good fit if you:
- Run Microsoft 365 or Google Workspace with no on-premises domain and want an independent identity provider
- Have several directories and want one sign-in across them
- Want breached-password checks and a route to passwordless without buying a separate identity platform
- Already license Duo Essentials or above and want more value from it
If you have a healthy Active Directory or Entra ID estate, you may simply sync it into Duo and carry on managing users there. We will map your current directories, decide which is the source for whom, and set up sync, provisioning and SSO in a sensible order. Contact us to talk it through.
How Forever Systems supplies and supports Cisco Duo
We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.
- Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
- Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
- Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
- Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
- Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Duo quote, trial or roll-out plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Duo Directory?
Duo Directory is a cloud user directory in Cisco Duo. It holds users and groups so that Duo Single Sign-On can act as your identity provider, either with users created in Duo or synced from Active Directory, Entra ID, Google, OpenLDAP or a SCIM source.
Which Duo editions include Duo Directory?
Duo Directory is included in Duo Essentials, Duo Advantage and Duo Premier at no extra charge. It is not part of Duo Free.
Does Duo Directory replace Active Directory?
Not like for like. It is a directory for signing in to applications, not a tool for joining PCs to a domain or applying Group Policy. Cloud-first organisations can use it as their main identity store, while organisations with AD usually sync AD into Duo.
Can Duo Directory provision users to Microsoft 365?
Yes. Outbound SCIM 2.0 provisioning creates and updates accounts in Microsoft 365, Google and other SCIM-capable applications. Without on-premises AD, Duo requires this provisioning for Microsoft 365 SSO and passwordless.
Does Duo Directory check for breached passwords?
Yes. Duo Directory can check new passwords against known breached passwords, force password changes, and allow passwordless-only sign-in once users have strong authenticators.