IRONCLADHELP CENTERBack to Portal
All docs

Connecting Duo Security

Overview

Connecting Duo Security lets Ironclad pull in authentication and administrative activity from your Duo account so multi-factor authentication events show up alongside your other security data.

Before you start: You'll need access to your Duo Admin Panel with permission to create an application.

Step 1: Create an Admin API application in Duo

  1. Log in to the Duo Admin Panel.
  2. Go to Applications > Protect an Application.
  3. Search for Admin API and click Protect next to it.
  4. Under Permissions, check Grant read resource. This permission is required for Ironclad to read Duo activity; leaving it unchecked causes authorization (403) errors.
  5. Save the application. Duo will show you three values: an Integration key, a Secret key, and an API hostname. Keep this page open — you'll copy these into the portal next.

Step 2: Connect it in the portal

  1. Log in to the Ironclad portal.
  2. Make sure the correct customer is selected in the scope bar at the top.
  3. In the left sidebar, under Administration, click Integrations.
  4. Find the Duo card and fill in:
Field Enter the Duo value for…
API Hostname API hostname
Integration Key Integration key
Secret Key Secret key
  1. Check the Enabled checkbox.
  2. Click Save. You'll see a brief Saved confirmation.

These fields are write-only credentials. Once saved, the portal shows a mask plus only the final three characters, so you can confirm which value is configured without exposing the full key. Re-enter a field only when rotating that credential.

Step 3: Confirm it's working

Once saved and enabled, Ironclad begins pulling Duo activity on a regular interval. Check your Ironclad SIEM dashboard for Duo events to confirm data is flowing — it can take a little while for the first events to appear.

Troubleshooting

  • No data after saving: double-check all three values were copied exactly from the Duo Admin Panel — a single mismatched character in the Secret Key is the most common cause.
  • Authorization errors (403): in Applications, open the Admin API application associated with the Integration Key configured in Ironclad and confirm Grant read resource is checked under Permissions. Also confirm the application has not been deleted or deauthorized.