Duo Single Sign-On for Mimecast
Last updated:
Overview
As business applications move from on-premises to cloud hosted solutions, users experience password fatigue due to disparate logons for different applications. Single sign-on (SSO) technologies seek to unify identities across systems and reduce the number of different credentials a user has to remember or input to gain access to resources.
While SSO is convenient for users, it presents new security challenges. If a user's primary password is compromised, attackers may be able to gain access to multiple resources. In addition, as sensitive information makes its way to cloud-hosted services it is even more important to secure access by implementing two-factor authentication and zero-trust policies.
About Duo Single Sign-On
Duo Single Sign-On is our cloud-hosted SSO product which layers Duo's strong authentication and flexible policy engine on top of Mimecast logins. Duo Single Sign-On acts as an identity provider (IdP), authenticating your users using existing on-premises Active Directory (AD) or another SSO IdP. Duo SSO prompts users for two-factor authentication and performs endpoint assessment and verification before permitting access to Mimecast.
Duo Single Sign-On is available in Duo Premier, Duo Advantage, and Duo Essentials plans, which also include the ability to define policies that enforce unique controls for each individual SSO application. For example, you can require that Salesforce users complete two-factor authentication at every login, but only once every seven days when accessing Mimecast. Duo checks the user, device, and network against an application's policy before allowing access to the application.
Configure Single Sign-On
Before configuring Mimecast with Duo SSO using Security Assertion Markup Language (SAML) 2.0 authentication you'll first need to configure a working authentication source.
Once you have your SSO authentication source working, continue to the next step of creating the Mimecast application in Duo.
Create the Mimecast Application in Duo
-
Log in to the Duo Admin Panel and navigate to Applications → Application Catalog.
-
Locate the entry for Mimecast with the "SSO" label in the catalog. Click the + Add button to start configuring Mimecast. See Protecting Applications for more information about protecting applications with Duo and additional application options. You'll need the information on the Mimecast page under Metadata later.
-
No active Duo users can log in to new applications until you grant access. Update the User access setting to grant access to this application to users in selected Duo groups, or to all users. Learn more about user access to applications. If you do not change this setting now, be sure to update it so that your test user has access before you test your setup.
This setting only applies to users who exist in Duo with "Active" status. This does not affect application access for existing users with "Bypass" status, existing users for whom the effective Authentication Policy for the application specifies "Bypass 2FA" or "Skip MFA", or users who do not exist in Duo when the effective New User Policy for the application allows access to users unknown to Duo without MFA. -
Mimecast uses the Mail attribute when authenticating. We've mapped the <Email Address> attribute to external authentication source attributes as follows:
Default Attribute Active Directory SAML IdP <Email Address> mail Email If you are using a non-standard email attribute for your authentication source, check the Custom attributes box and enter the name of the attribute you wish to use instead.
-
You can adjust additional settings for your new SAML application at this time — like changing the application's name from the default value, enabling self-service, or assigning a group policy.
-
Keep the Duo Admin Panel tab open. You will come back to it later.
Duo Universal Prompt
The Duo Universal Prompt provides a simplified and accessible Duo login experience for web-based applications, offering a redesigned visual interface with security and usability enhancements.
| Universal Prompt | Traditional Prompt |
 |
 |
The Duo Mimecast application supports the Universal Prompt by default, so there's no additional action required on your part to start using the newest authentication experience.
Activate Universal Prompt
Activation of the Universal Prompt is a per-application change. Activating it for one application does not change the login experience for your other Duo applications. Universal Prompt is already activated for new Mimecast applications at creation.
The "Universal Prompt" area of the application details page shows that this application's status is "Activation complete", with these activation control options:
- Show traditional prompt: Your users experience Duo's traditional prompt via redirect when logging in to this application.
- Show new Universal Prompt: (Default) Your users experience the Universal Prompt via redirect when logging in to this application.
The application's Universal Prompt status shows "Activation complete" both here and on the Universal Prompt Update Progress report.
For the time being, you may change this setting to Show traditional prompt to use the legacy experience. Keep in mind that support for the traditional Duo prompt ended for the majority of applications in March 2024. This option will be removed in the future.
Universal Update Progress
Click the See Update Progress link to view the Universal Prompt Update Progress report. This report shows the update availability and migration progress for all your Duo applications. You can also activate the new prompt experience for multiple supported applications from the report page instead of visiting the individual details pages for each application.
Enable Mimecast for SSO
You can enable Mimecast for SSO using a personal portal application or an administration console application.
Configure the Personal Portal Application
-
Log into your Mimecast account as an administrator.
-
Click the Administration Console tile. The "Administration Console" page opens in a new tab.
-
In the sidebar menu, navigate to Users & Groups → Applications.
-
At the top of the page, click Authentication Profiles.
-
Click New Authentication Profile.
-
Enter unique name for your authentication profile into the Description field.
-
Scroll down and click the Enforce SAML Authentication for Mimecast Web Apps checkbox.
-
Under "SAML Configuration for Mimecast Web Apps", click the Provider drop-down menu and select Other.
-
Return to the Duo Admin Panel. Under "Metadata", copy the Metadata URL and paste it into the Mimecast Metadata URL field and then click Import.
-
In Mimecast, scroll down make sure the Allow Single Sign On checkbox is selected.
-
Uncheck the Use Password Protected Context and Use Integrated Authentication Context checkboxes.
-
Scroll to the top of the page and click Save and Exit.
-
At the top of the page, click Go Back.
-
Click New Application Settings.
-
Under "General", enter a unique name for your application settings into the Description field.
-
Next to the Group field, click Lookup.
-
Under "Local Groups", click your desired local group.
-
Next to the Authentication Profile field, click Lookup.
-
Click Select next to the authentication profile that you created earlier.
-
At the top of the page, click Save and Exit.
-
Your applicable email address should exist in Profile Groups, and it needs to belong to any Internal Directories in the sidebar menu under Users & Groups.
-
In the sidebar menu, navigate to Account → Account Settings.
-
Under "Account Settings", copy the Account Code and paste it into the Duo Admin Panel Account Code field, under "Service Provider".
-
In the Duo Admin Panel, click the Region drop-down menu and select your applicable region.
-
Click the Application drop-down menu and select Personal Portal.
-
Scroll down to the bottom of the page and click Save.
Configure the Administration Console Application
Note: To use the Administration Console application, the user must have an administrator role.
-
Log into your Mimecast account as an administrator.
-
Click the Administration Console tile. The "Administration Console" page opens in a new tab.
-
In the sidebar menu, navigate to Users & Groups → Applications.
-
At the top of the page, click Authentication Profiles.
-
Click New Authentication Profile.
-
Enter unique name for your authentication profile into the Description field.
-
Scroll down and click the Enforce SAML Authentication for Administrators checkbox.
-
Under "SAML Configuration for Administrators", click the Provider drop-down menu and select Other.
-
Return to the Duo Admin Panel. Under "Metadata", copy the Metadata URL and paste it into the Mimecast Metadata URL field and then click Import.
-
In Mimecast, scroll down make sure the Allow Single Sign On checkbox is selected.
-
Uncheck the Use Password Protected Context and Use Integrated Authentication Context checkboxes.
-
Scroll to the top of the page and click Save and Exit.
-
At the top of the page, click Go Back.
-
Click New Application Settings.
-
Under "General", enter a unique name for your application settings into the Description field.
-
Next to the Group field, click Lookup.
-
Under "Local Groups", click your desired local group.
-
Next to the Authentication Profile field, click Lookup.
-
Click Select next to the authentication profile that you created earlier.
-
At the top of the page, click Save and Exit.
-
Your applicable email address should exist in Profile Groups, and it needs to belong to any Internal Directories in the sidebar menu under Users & Groups.
-
In the sidebar menu, navigate to Account → Account Settings.
-
Under "Account Settings", copy the Account Code and paste it into the Duo Admin Panel Account Code field, under "Service Provider".
-
In the Duo Admin Panel, click the Region drop-down menu and select your applicable region.
-
Click the Application drop-down menu and select Administration Console.
-
Scroll down to the bottom of the page and click Save.
Learn more about Mimecast SSO at Mimecast Support.
Using SSO
You can log on to Mimecast by navigating to the Mimecast SSO page using your applicable region e.g., https://login-yourregion.mimecast.com. Type the email address you noted earlier and then click Next to be redirected to Duo Single Sign-On to begin authentication.
Active Directory Login
With Active Directory as the Duo SSO authentication source, enter the primary username (email address) on the Duo SSO login page and click or tap Next.
Enter the AD primary password and click or tap Log in to continue.
Enable Duo Passwordless to log in to Duo SSO backed by Active Directory authentication without entering a password in the future.
SAML Login
The SAML login experience depends on your Duo SSO routing rules configuration.
With another SAML identity provider as the only enabled Duo SSO authentication source and the default routing rule in place, Duo SSO immediately redirects the login attempt to that SAML IdP for primary authentication. Users do not see the Duo SSO primary login screen.
If you have multiple enabled SAML authentication sources or custom routing rules in place, then users enter their primary username (email address) on the Duo SSO login page and then will be redirected to the correct external SAML identity provider.
Duo Authentication
Successful verification of your primary credentials by Active Directory or a SAML IdP redirects back to Duo. Complete Duo two-factor authentication when prompted and then you'll return to Mimecast to complete the login process.
* Universal Prompt experience shown.
You can also log into Mimecast using Duo Central, our cloud-hosted portal which allows users to access all of their applications in one spot. Link to Mimecast in Duo Central by adding it as an application tile. Once the tile has been added, log into Duo Central and click the tile for IdP-initiated authentication to Mimecast.
Congratulations! Your Mimecast users now authenticate using Duo Single Sign-On.
See the full user login experience, including expired password reset (available for Active Directory authentication sources) in the Duo End User Guide for SSO.
Grant Access to Users
If you did not already grant user access to the Duo users you want to use this application be sure to do that before inviting or requiring them to log in with Duo.
Enable Remembered Devices
To minimize additional Duo two-factor prompts when switching between Mimecast and your other Duo Single Sign-On SAML applications, be sure to apply a shared "Remembered Devices" policy to your SAML applications.
Automated Provisioning
You may be able to create, manage, and delete users and groups in this application automatically from Duo using SCIM 2.0 provisioning. See Automated Provisioning to learn how.
Troubleshooting
Need some help? Try searching our Knowledge Base articles or Community discussions. For further assistance, contact Support.