Skip navigation
Documentation

Trusted Endpoints - Jamf Pro Certificate Deployment

Duo's Trusted Endpoints feature secures your sensitive applications by ensuring that only known devices can access Duo protected services. When a user authenticates via the Duo Prompt, we'll check for the presence of a Duo device certificate on that endpoint. You can monitor access to your applications from devices with and without the Duo certificate, and optionally block access from devices without the Duo certificate.

Before enabling the Trusted Endpoints policy on your applications, you'll need to deploy the Duo device certificate to your managed devices. This guide walks you through using Jamf Pro to distribute a certificate enrollment script to your managed devices.

Prerequisites

  • Access to the Duo Admin Panel as an administrator with the Owner, Administrator, or Application Manager administrative roles.
  • Access to the Jamf Pro Dashboard as an administrator with the rights to create new policies and apply them to user targets.

Create the Jamf Pro Integration

  1. Log in to the Duo Admin Panel and navigate to Trusted Endpoints Configuration.
  2. If this is your first management integration, click the Configure Management Tools Integration button at the bottom of the page. If you're adding another management integration, click the Add Integration button you see instead.
  3. On the "Select Management Tools Integration" page, locate Jamf Pro in the listed integrations and click the Select this integration link to the right.

The new Jamf Pro integration is created in the "Off" state. You'll turn it on when you're ready to apply your Duo trusted endpoints policy.

Keep the Admin Panel open in your browser to complete the next step of importing a script from Duo into Jamf Pro.

Import the Duo Deployment Script to Jamf

Duo provides you with a certificate enrollment script you can import to a Jamf Pro policy. This script installs the Duo device certificate on targeted systems. The Duo script also configures Safari and Google Chrome browsers to automatically select Duo's device certificate during the authentication process.

To create the Duo policy in Jamf Pro:

  1. Log on to the Jamf Pro dashboard as an administrator and navigate to ComputersManagement Settings.

  2. Click the Scripts icon under Computer Management, and then click the + New button on the "Scripts" page.

  3. Enter the following information on the General options tab:

    Display Name Enter a descriptive name for the new script, like "Duo Enrollment Script".
    Category (Optional) Categorize the script if you wish.
    Information (Optional) Enter identifying information about the Duo script.
    Notes (Optional) Enter notes about the Duo script.

    Jamf Script General Options

  4. Click the Script tab in Jamf Pro.

  5. Switch to your Duo Admin Panel browser window, open to the "Jamf Pro" management tools integration. Click the Copy script to clipboard button in the the "Copy the Jamf Enrollment Script" section of the page (step 1).

    Jamf Script in Duo Admin Panel

  6. Return to the Jamf Pro dashboard and paste the Duo script you just copied from the Admin Panel into the Script Contents box.

    Jamf Script Contents

  7. Click the Save button once you paste the Duo script contents. The script doesn't require any changes to "Options" or "Limitations".

  8. Click the Done button.

Add the Duo Script to a Jamf Computer Policy and Apply to Clients

To add the new Duo script to a new or existing computer policy:

  1. Navigate to ComputersPolicies in the Jamf Pro console. Click the + New button (or click on an existing policy and click the Edit button, then skip to step 3 below).

  2. To begin creating a new policy, enter the following information on the General options tab:

    Display Name Enter a descriptive name for the new policy, like "Duo Certificate Policy".
    Enabled Leave this option checked.
    Trigger Choose the options that make sense for your environment. We recommend Login and Recurring Check-in at minimum.
    Execution Frequency This policy should run again periodically to ensure timely renewal of the client's Duo certificate. We recommend Once every day as the minimum frequency.

    Jamf Policy General Options

  3. Click the Scripts item on the left, and then click the Configure button on the "Configure Scripts" page.

  4. Locate the Duo enrollment script you imported earlier in the list of scripts and click the Add button next to it. It is not necessary to change the script priority or add any parameters.

    Jamf Policy Script

  5. If you created a new policy, then you need to apply it to target systems. Click the Scope tab.

  6. Determine whether you want to target all computers or just a subset with the Target Computers drop-down menu.

  7. If you selected Specific Computers in the previous step, click the Add button and then select your desired target computers or computer groups by clicking the Add button next to their names. Click the Done button after you've selected all the targets.

    Jamf Policy Scope

  8. Click the Save button at the bottom of the page once you've added the script and defined the scope.

  9. To see the status of this policy on the dashboard, check the Show in JSS Dashboard option on the far right of the policy editor. Click the Done button at the bottom of the page.

Verify Your Setup

Monitor the status of your Duo certificate policy by returning to the Jamf Pro dashboard periodically.

Jamf Dashboard

You can use the this command from a Terminal window on a target device to force a policy update:

sudo jamf policy

To confirm that your Jamf Pro policy worked, you can open the macOS Keychain Access application on a computer that successfully processed the Duo Jamf policy and make sure the Duo Device Authentication certificate is present in the "duo-auth" keychain.

Jamf macOS Certificate Verification

Finish Trusted Endpoints Deployment

Once your managed computers start receiving the Duo certificate you can configure the Trusted Endpoints policy to start checking for the certificate as users authenticate to Duo-protected services and applications.

When your trusted endpoints policy is applied to your Duo applications, return to the Jamf Pro trusted endpoint management integration in the Admin Panel and turn it On with the Off/On setting at the top of the page.

The Device Insight and Endpoints pages in the Duo Admin Panel show which access devices have the Duo certificate present.

As more of your devices receive the Duo certificate you can adjust your trusted endpoints policy to expand the target group, apply it to additional protected services, or start blocking access to applications from devices that do not have the Duo certificate. See the Trusted Endpoints documentation for more information.

Removing the Jamf Pro Management Integration

Deleting a trusted endpoints management tool integration from the Duo Admin Panel immediately invalidates issued Duo device authentication certificates. Be sure to unassign your trusted endpoints policy from all applications or remove the "Trusted Endpoints" configuration item from your global policy before deleting an existing Jamf Pro integration from "Trusted Endpoints Configuration". You should also disable your Duo policy in Jamf.

Leaving the policy settings in place after deleting a management tools integration may inadvertently block user access to applications.

Troubleshooting

Need some help? Take a look at our Trusted Endpoints Knowledge Base articles or Community discussions. For further assistance, contact Support.

Ready to Get Started?

Sign Up Free