Duo Agentic Identity for Cisco AI Defense

Duo Agentic Identity for Cisco AI Defense is a Beta feature.

Overview

AI agents connected to tools via the Model Context Protocol (MCP) are part of enterprise workflows, executing complex tasks autonomously on behalf of users. This creates a critical security gap: how do you control what an AI agent can do and on whose behalf?

Traditional access controls do not address agentic workloads, where an agent may invoke dozens of tools on a user's behalf with no native mechanism to enforce who can access what. Without tool-level authorization, enterprises risk over-privileged agents, ambiguous identity, and incomplete audit trails.

Cisco AI Defense acts as a managed gateway for MCP servers — discovering tools and enforcing runtime protection. When integrated with AI Defense, Duo serves as the identity and authorization engine. On each tool invocation, Duo extracts the access token from the authenticated request and evaluates it against centrally managed authorization policies. Based on the allow-or-deny decision, Duo enforces fine-grained authorization before any MCP tool call reaches the back-end server.

Key capabilities:

• MCP server onboarding and tool discovery in AI Defense.
• User authentication via Duo OAuth 2.1/OIDC with Dynamic Client Registration (DCR) or Client ID Metadata Documents (CIMD).
• User identity extraction and Duo group membership lookup.
• Fine-grained tool-level authorization policies mapped to Duo user groups.
• Audit trail of all agent-to-tool invocations.

Duo Agentic Identity for AI Defense requires a Duo Premier plan subscription.

Prerequisites

Before you begin, make sure you have the following:

• A Duo Premier plan subscription or an active Duo Premier trial.
• An AI Defense subscription.
• Access to the Duo Admin Panel as an administrator with the Owner or Administrator administrative role or equivalent custom role.
• Duo configured as an identity provider (IdP) in AI Defense.
• At least one MCP server registered in AI Defense.
• (Optional) Users and groups provisioned or synced to the Duo Directory. You may also manually create users and groups to target with your MCP tool access policies.

Generate an API Key in AI Defense

Create an Inspection API key in AI Defense that Duo will use to communicate with the AI Defense gateway. You will paste this key into the Duo Admin Panel in a later step.

1. Log in to the AI Defense dashboard in Cisco Security Cloud.

2. Click Applications, then click Add Application. Enter Duo AI Gateway as the Name, choose API as the type, and click Continue.

3. In the application, open the API Connections page and click Add Connection. Enter Duo as the connection name and click Add connection.

4. On the Add API key page, enter an API key name (like Duo), set the expiration date option to Never Expire, and click Generate API Key.

5. Copy the generated API key and store it in a secure location. You will need this key when you create the AI Defense application in Duo.

For more information about generating Inspection API keys, refer to the AI Defense API key documentation.

Create the MCP Application in Duo

This application handles inbound user authentication to AI Defense using Duo Single Sign-On with Dynamic Client Registration (DCR) or Client ID Metadata Documents (CIMD).

1. Log in to the Duo Admin Panel and navigate to Applications → Application Catalog.

2. Locate the entry for Model Context Protocol (MCP) - Single Sign-On with the "SSO" label in the catalog. Click the + Add button to start configuring Model Context Protocol (MCP) - Single Sign-On. See Protecting Applications for more information about protecting applications with Duo and additional application options. You'll need the information on the Model Context Protocol (MCP) - Single Sign-On page later to complete your setup.

3. No active Duo users can log in to new applications until you grant access. Update the User access setting to grant access to this application to users in selected Duo groups, or to all users. Learn more about user access to applications. If you do not change this setting now, be sure to update it so that your test user has access before you test your setup.

   This setting only applies to users who exist in Duo with "Active" status. This does not affect application access for existing users with "Bypass" status, existing users for whom the effective Authentication Policy for the application specifies "Bypass 2FA" or "Skip MFA", or users who do not exist in Duo when the effective New User Policy for the application allows access to users unknown to Duo without MFA.

4. On the General tab, configure the following settings:

   Setting	Value
   Grant Type	Select Authorization Code for user AI agents.
   Access Token Lifetime	(Optional) Adjust the access token lifetime as needed. Minimum: 5 minutes.
   Sign-In Redirect URLs	https://sso.duosecurity.com/oidc/default/callback
   Resource URL	Your AI Defense MCP URL(s) ending with /mcp. AI Defense can be configured with multiple public URLs for accessing MCP server resources, so ensure all of them are configured as Resource URLs.

   

5. On the Scopes tab, optionally update the attribute mapping of the default scopes, add custom scopes, or configure claim transformations if needed.

6. On the Clients tab, make these changes in the "Public Client Registration" section:

   1. Under "Public Client Registration", click in the Scopes field to add the openid, profile, and email scopes.
   2. Enable one or both of the following registration options: Enable clients to self-register using CIMD and Enable clients to register themselves during the authentication flow.

   Verify that your clients support CIMD registration before enabling that option.

   

7. Adjust additional settings for your new MCP application at this time — like changing the application's name from the default value or assigning policies or administrative units.

8. Click Save.

Add Ownership and Risk Information

Go to the "Ownership and Risk" section of the application's page in the Duo Admin Panel to assign application owners and classify the application's risk level. Cisco Identity Intelligence automatically imports this information to populate relevant fields.

You may set any of the following:

• Technical Owner: Search for and assign Duo users responsible for technical configuration and maintenance of this application.
• Business Owner: Search for and assign Duo users responsible for business decisions and access approvals related to this application.
• Application Sensitivity: Select this application's risk level from the drop-down list. Default: Not Set.
• Compliance Requirements: Select any applicable regulatory frameworks for this application (SOX (Sarbanes-Oxley), HIPAA, PCI-DSS, etc.) from the list.

Scroll to the bottom of the page and click Save to apply your changes.

Create the AI Defense Application in Duo

This application provides the credentials that Duo uses to connect to the AI Defense gateway for tool-level authorization decisions.

1. Log in to the Duo Admin Panel and navigate to Applications → Application Catalog.

2. Locate the entry for AI Defense in the catalog. Click the + Add button to create the application, and get your integration key, secret key, and API hostname. You'll need this information to complete your setup. See Protecting Applications for more information about protecting applications with Duo and additional application options.

3. Paste the API key you generated in AI Defense as the AI Defense API secret.

4. Use the "OIDC Integration" drop-down to select the MCP integration you created earlier for use with AI Defense.

5. Adjust additional settings for your new AI Defense application at this time — like changing the application's name from the default value or assigning an administrative unit.

6. Click Save.

   

Add Ownership and Risk Information

Go to the "Ownership and Risk" section of the application's page in the Duo Admin Panel to assign application owners and classify the application's risk level. Cisco Identity Intelligence automatically imports this information to populate relevant fields.

You may set any of the following:

• Technical Owner: Search for and assign Duo users responsible for technical configuration and maintenance of this application.
• Business Owner: Search for and assign Duo users responsible for business decisions and access approvals related to this application.
• Application Sensitivity: Select this application's risk level from the drop-down list. Default: Not Set.
• Compliance Requirements: Select any applicable regulatory frameworks for this application (SOX (Sarbanes-Oxley), HIPAA, PCI-DSS, etc.) from the list.

Scroll to the bottom of the page and click Save to apply your changes.

Configure Authorization Policy

Define which Duo user groups can invoke which MCP tools through AI Defense. The MCP gateway allows no tool use without configured rules or policy.

Create User Groups

You may use Duo user groups managed via directory sync or inbound SCIM in your authorization policy. Assign users to the target groups in the external directory and sync the changes into Duo.

If you need to create authorization groups manually:

1. Log in to the Duo Admin Panel and navigate to Users → Groups.

2. Create groups that correspond to the tool-level access you want to enforce. For example:

   Group	Description
   Engineering	Access to code generation and repository tools
   Finance	Access to financial reporting and analytics tools
   Admin	Access to all available tools

3. Assign users to the appropriate groups.

For more information about creating and managing Duo groups, refer to Using Groups.

Set Up Tool-Level Authorization

1. In the Duo Admin Panel, navigate to Applications → MCP Gateways and Servers.

2. On the "MCP Gateways and Servers" page, locate the AI Defense server you want to configure policy for, and click Configure policy. There may be more than one AI Defense server listed.

3. Enter the policy details describing the intent of the new policy.

4. In the "Configure Policy" section, click + Add another rule.

   1. Use the For user groups drop-down to select one or more Duo groups. Users in any of the selected groups receive the specified access.

   2. Click Select tools in the "Allow tools" box to choose which tools members of the selected groups can invoke. Make your selections from the available tools list on the right to add them to the rule. Click Close on the "All Tools" list when you complete your tool selections.

   3. Verify your group and tool selections in the new rule.

5. Click + Add another rule to create additional rules as needed for other group and tool combinations or Remove rule to delete a rule from the policy.

6. Click Save policy after creating your tool rules.

Test Your Setup

After completing the configuration steps, you will have:

• Duo connected to the AI Defense gateway via the AI Defense application.
• An MCP server registered in AI Defense.
• A Duo authorization policy configured for the MCP server.

Verify the authorization flow with an MCP client.

Configure an MCP Client

This example uses the Claude Code CLI as the MCP client. You can substitute any MCP-compatible client.

1. Add the AI Defense MCP gateway as an MCP server:

   claude mcp add ai-defense -t http https://your-ai-defense-mcp-url/mcp/.....

   Replace your-ai-defense-mcp-url with your actual AI Defense MCP URL.

2. Launch Claude Code:

   claude

3. Type /mcp to view the list of configured MCP servers.

4. Select the ai-defense entry and press Enter to confirm.

5. Select Authenticate and press Enter to authenticate via Duo Single Sign-On.

6. Claude Code launches your default web browser with the Duo SSO authentication URL. If your browser doesn't launch automatically, copy the URL provided in the text output and paste it into a new browser tab.

7. Log in to Duo SSO and complete additional authentication when prompted.

   

Verify Tool-Level Authorization

1. After authentication, use /mcp to view available MCP tools. Confirm the list matches your group permissions.

2. Invoke a tool that your group has access to. The request succeeds and returns results.

3. If you have access to a second user account that is not authorized for certain tools, authenticate as that user and confirm that unauthorized tools do not appear in the tools list.

Logs

View tool-based authorization activity across MCP servers in the Client Authorization Log.

Troubleshooting

Need some help? Take a look at our AI Defense Knowledge Base articles or Community discussions. For further assistance, contact Support.

Common Issues