Skip navigation

Duo Security is now a part of Cisco

About Cisco

Documentation

Administration Overview - Using the Admin Panel

Last Updated: May 17th, 2019

Contents

Every aspect of your Duo two-factor authentication system can be managed from the Duo Admin Panel. This includes creating and managing applications, enrolling and activating users, issuing and managing SMS passcodes and bypass codes, managing mobile devices, fine-tuning the user experience of your Duo installation, and more.

Video Overview

Accessing the Duo Admin Panel

Logging In

To access the Duo Admin Panel, navigate to Duo Admin Panel, enter your administrator account email address and password, and click Log In. Your browser must support TLS 1.2, which most modern browsers do by default. If you are concerned about compatibility, please update your browser or check your browser’s SSL implementation here: https://www.ssllabs.com.

Admin User Login Prompt

After your login information is accepted, click on a second factor. Complete secondary authentication to continue on to the Admin Panel.

Admin User 2FA Prompt

Factor Description
Duo Push Sends an authentication request to the Duo Mobile app on your device. Approve the request on your phone to log in.
Text Me Sends a passcode via SMS to your phone. Type the passcode in the box where prompted and click Submit. This passcode is good for five minutes.
Call Me Calls you with a passcode. Type the passcode in the box where prompted and click Submit. This passcode is good for five minutes.

You must activate your administrator account for Duo Mobile separately from your user account to use Duo's push authentication with the Admin Panel. See Managing Duo Administrators for instructions.

If you've forgotten your password, click the Forgot Password link. Enter the email address that you use to log in to your Duo administrator account and click Submit. Check your email for your password reset link.

Reset Forgotten Administrator Password

Admin Panel Overview

Dashboard

The Admin Panel dashboard gives you a snapshot of your organization's activity.

Admin Panel Dashboard

When viewing the dashboard keep in mind that we round very large quantities for the dashboard display, but you can click any of the numbers to see an exact count.

The information shown first on the dashboard provides a quick overview of users with bypass or locked out status, inactive users who haven't logged in recently, and your total end user count. Click on any of these items to view a filtered list of users.

Click the "Licenses Remaining" link to view the Deployment Progress report, which tracks how many end users there are in your Duo deployment, how many applications you've protected with Duo, the average number of 2FA devices per user, and the top authentication method used over the last 24 hours.

The endpoints summary information on the dashboard indicates how many of your endpoints have outdated operating systems and shows how that number has changed over the last week. Click the "Out of Date OS" or "Total Endpoints" link to view more detailed information on the Device Insight page.

Click anywhere on the interactive graph of your most recent authentication successes and failures to view the Authentication Log, filtered to display the related events.

The Authentication Log lists information about the last ten Duo login attempts, including the following:

  • Date and time of the access attempt
  • Whether the authentication was successful or not and why
  • The Duo username
  • Which application was accessed
  • Access device information, such as the source IP address and location (if the login originated from a public IP address), the client OS, browser, and plugin information, and trusted status
  • Second factor device information, such as the type of Duo factor used, the device's phone number, and source IP address and location (if the Duo Push response originated from a public IP address)

You can click the "Full authentication log" link to view all login events.

Along the far right side of the Admin Panel dashboard is our "What's New?" feed, where we'll call your attention to new features and enhancements to the Duo service.

Click the Add New... button in the top right of the Dashboard to quickly create a new user, group, or application (you can also click the navigation link of the left for the type of object you want to create).

Quick Add

Click on your name in the upper-right corner to access your administrator account action menu. Edit Profile lets you change the name associated with your administrator login, reset your password for the Admin Panel, update your secondary authentication phone number, and activate Duo Mobile for Admin Panel login. You can also click Log Out on this menu to end your Duo administrator session. You'll be logged out of the Admin Panel automatically after 60 minutes of inactivity.

Navigation

Manage or view different object types by clicking the links on the left side of the Admin Panel. You may be shown a subset of these links, depending on your assigned administrative role.

You'll find Duo's support information on the left side of the Admin Panel as well. Paying customers may click the Support Tickets link on the left create and manage support cases in the customer portal. You'll need your Account ID information from the left side of the Admin Panel if you contact Duo support via phone or email.

Additionally, you'll find your Deployment ID on the left, under your Account ID. Clicking the Deployment ID takes you to the Duo Service Status page, where you can see the current operational status of Duo's cloud systems.

Viewing Information

Use the search field at the top right of the Admin Panel to quickly find a particular user (by username or alias), phone or token device, group, or application.

Quick Search

Clicking most of the navigation items on the left of the Admin Panel window takes you to a table view of those objects (i.e. clicking Users shows you a table of Duo users).

Information tables in Duo are either paginated, where you can change the page size from 250 to 100 items and click forward and back between pages, or the table shows a Load More button at the bottom of the current data view that you can click to show more information. Most tables have a search field in the upper right that you can use to filter records in place.

If the table has an Export button, you can click that to download information in CSV, JSON, or PDF format, or select URL to obtain a direct link to your current view. If you've filtered the information in the table using search, the downloaded information only includes those search results.

Reports

All administrator roles except Billing can view reports. Clicking the Reports link on the left side of the Admin Panel takes you to the Authentication Log.

Authentication Log

The default view shows authentication events for the previous 24 hours. You'll see a visual representation of authentication successes and failures, and a list of authentication attempts that shows the following information:

  • When the login was attempted
  • Whether the login attempt was successful or not (if access is denied, a reason is provided)
  • The username
  • Which application was used
  • The access client's operating system -Click browser, and browser plugin information (if using a web based application with the inline Duo Prompt
  • The location from which the login attempt originated (if a publicly resolved IP address)
  • The client IP address (if the client sends IP information)
  • What type of Duo authenticator was used (Duo Push, SMS, phone call, etc)
  • Information about the device that was used for Duo authentication (phone number, location, IP address, etc.)

Authentication Log

Duo Beyond and Duo Access plan customers also see events for users that access an application without two-factor authentication as a result of setting the New User Policy setting to "allow access".

To narrow down the authentication logs shown, click on "Last 24 Hours - No filters applied" (the default) at the top of the page to expand the filtering options. You can expand the time range up to a maximum of 180 days, filter the authentication log information by typing in all or part of a user, application, or group name, or select from other criteria like second factor devices used to authenticate or authentication log success or failure reasons.

Authentication Log Filtering

Click the Export button in the upper right side of the log display and select JSON or CSV to download a copy of the authentication log. You can also select Print to go directly to your browser's print dialog. If you've added any filters to your current view of the log, the report only includes the filtered results.

Telephony Log

The telephony log shows all the phone calls and SMS messages sent by Duo. These could be initiated by administrator login to the Admin Panel, user login to Duo protected services, or device enrollment and activations links sent to users and administrators (as shown in the "Context" column).

The number in the "Credits" column shows how many credits were deducted from your telephony credits balance for each phone call or message.

Telephony Log

Click the Export button in the upper right side of the log display and select CSV, JSON, or PDF to download a copy of the log. You can also select URL to obtain a direct link to your current telephony log view.

Administrator Actions Log

The administrator actions log shows activity by your organization's Duo administrators. Examples of logged administrator actions include:

  • Administrator login to the Admin Panel
  • Tasks like adding, modifying, or deleting phones, users, tokens, applications, and other administrators
  • Directory sync start and end and any updates made by the sync

Administrator Actions Log

Click on the link in the "Action" column to see more details.

Authentication Log Filtering

The authentication log event display may be filtered by administrator.

Authentication Log Filtering

Click the Export button in the upper right side of the log display and select CSV, JSON, or PDF to download a copy of the log.You can also select URL to obtain a direct link to your current administrator actions log view. If you've added any filters to your current view of the log, the report only includes the filtered results.

Log Retention

Duo authentication, telephony, and administrator action log entries are retained indefinitely by default. Change the log retention period to your desired maximum number of days in the “Logging” setting.

Troubleshooting

Need some help? Try searching our Knowledge Base articles or Community discussions. For further assistance, contact Support.

Ready to Get Started?

Sign Up Free