Can Duo Directory be used as a standalone cloud directory service?

Yes. Duo Directory can operate independently as a standalone cloud directory service, allowing you to create and manage users and groups directly in Duo without requiring on-premises directory infrastructure. Duo provides organizations a path to security-first IAM by combining directory, SSO, MFA, device trust, and access policy capabilities in a single platform.

Can Duo Directory support multiple identity directories simultaneously?

Yes. Duo Directory supports multiple identity sources and routing rules allowing organizations to direct different users to the proper authentication source. For example, employees can authenticate through Active Directory, while contractors, vendors, or other external users can be routed to authenticate through Duo Directory.

What identity sources can Duo Directory sync with?

Directory supports automatic sync from Microsoft Active Directory, Microsoft Entra ID, Okta via SCIM 2.0, Google, OpenLDAP, and any SCIM 2.0-compliant directory. You can also import users manually or from CSV. Outbound automated provisioning pushes users and groups into Microsoft 365, Google Cloud, and other SCIM-supported applications.

How does Duo Directory handle contractors and vendors?

Duo Directory runs side by side with your primary corporate directory as a dedicated identity store for external users. You create and manage contractor, vendor, and partner accounts directly in Duo, separate from your main directory. You apply specific access policies and enforce MFA the same way you would for employees. When an engagement ends, administrators can immediately deprovision the account, revoking access.

Do I need a separate Identity Governance (IGA) platform to handle Joiner, Mover, and Leaver (JML) workflows?

No, Duo Directory provides robust automated JML capabilities without the premium cost of a dedicated IGA platform. By utilizing SCIM automation and Directory Sync, Duo automatically updates user access based on your source directory. For movers and leavers, governance is strictly enforced. Users are blocked from Duo authentication immediately after the next directory sync detects their disabled or removed status in the source directory.

Do I have to replace my existing Active Directory or Okta to use Duo Directory?

No. Duo Directory is designed to work alongside your existing identity providers. It sits in front of your current IDPs as an identity broker, applying phishing-resistant MFA and adaptive policies, then passes authenticated users back. Your existing infrastructure stays intact. If you want to migrate away from an on-premises directory over time, Duo Directory can serve as a standalone replacement with migration tools built in.

How does Duo Directory work with existing Active Directory environments?

Duo Directory can integrate with Active Directory through Duo Directory Sync, which imports users, groups, and selected attributes into Duo. This one-way sync helps administrators use existing AD data for authentication, access policies, MFA, and lifecycle management while managing security controls in Duo.

How does Duo Directory complement existing Active Directory security solutions?

Duo Directory complements Active Directory security solutions by adding identity-first access protections such as phishing-resistant authentication, device trust, and adaptive access policies. Instead of replacing AD outright, Duo can help organizations apply stronger controls around the users and applications that depend on AD.

How does a Duo Active Directory integration reduce administrative overhead while maintaining security?

Establishing a Duo Active Directory integration allows you to seamlessly sync users, groups, and status changes from your on-premises infrastructure directly into the Duo platform so access policies stay aligned with directory changes. This reduces manual administration by automating user lifecycle management, supporting onboarding and offboarding workflows, and ensuring Duo authentication reflects current user status after directory sync.

Can administrators use Duo Directory to enforce stricter Active Directory security controls across all applications?

Duo Directory enables administrators to enforce robust Active Directory security controls by combining synced directory data, strong MFA, device trust, and access policies. By leveraging these Active Directory security controls, administrators can create granular access policies that automatically block access for deactivated users and ensure that only healthy, trusted devices can connect to sensitive corporate resources.

Duo Directory

Item: Cisco Duo
Author: Steve Fink

Simple, flexible, and built to defend against identity attacks

Streamline user access and reduce administrative overhead with Duo Directory, our unified, cloud-native identity hub. It's everything you need to easily secure and manage identities from Day One.

Try Duo for free

WHAT IS DUO DIRECTORY

Your integrated user directory

This robust user directory comes built into the Duo IAM platform. It manages accounts, provisioning, and authentication routing from the same console as your MFA and SSO. Use it as a standalone source of truth for user lifecycles or layer it in front of an existing IdP to add adaptive policies and phishing-resistant MFA.

HOW DOES DUO DIRECTORY WORK

Flexible identity management

Duo Directory functions in three distinct ways. 1. Deploy as a standalone identity store, 2. As an intelligent identity broker, 3. As an access manager to secure external users. It syncs users and attributes from sources like Active Directory, Entra ID, and Okta. Using directory sync and SCIM, Duo Directory also automates lifecycles and routes authentication requests in real time.

WHY CHOOSE DUO DIRECTORY

Close the identity-security gap

Duo combines directory and security enforcement into one simple, easy-to-manage tool, removing gaps that attackers exploit. Automated provisioning and IdP synchronization eliminate manual tasks and reduce the risk of stale accounts. It also helps simplify regulatory compliance through accurate, up-to-date, and auditable user records.

A user directory with built-in enforcement

Duo Directory forms the user backbone of a solution that handles provisioning, authentication routing, access policies, and deprovisioning from a single console. No extra infrastructure required. As losses pile up due to identity threats, don’t trust your security to anything else.

Manage all users across all lifecycles

Duo Directory manages employees, contractors, agents, and non-human identities across multiple identity providers from a single central solution. Its easy-to-use routing rules give you granular control over who authenticates, where, and how.

See how it works (9:01)

Secure external users

Contractors, vendors, and partners need access to specific tools. Duo Directory stores external identities, handles provisioning, and applies consistent security policies—keeping external accounts separate from your internal employee directory.

Secure users with adaptive access

Man in a blazer works on a laptop on a plane, with Google, Slack, and Dropbox icons beside him

Run Duo as your full directory

Run Duo Directory as a complete cloud-native identity store with no on-prem infrastructure. For teams migrating from Active Directory, the Cisco AI Assistant for Duo makes it easy, and routing rules let you run both systems in parallel so you can cut over at your own pace.

See how to set it up

Two coworkers smile at a laptop screen, with a green checkmark-cloud icon overlaid in the corner

Govern AI agent identities with Duo

AI agents authenticate, access tools, and trigger workflows, all at machine speed. As a result, 59% of security and IT leaders are concerned about securing AI.² Duo discovers agentic identities and MCP integrations across your environment, applies access privileges, and serves as an authorization and enforcement layer that governs access.

Explore agentic AI security

Man at a desk with dual monitors views authentication stats: 55 denied, 312 granted, 367 total

Which editions include Duo Directory?

Every paid edition includes Duo Directory along with phishing-resistant MFA, passwordless authentication, and SSO across your applications. All in one easy-to-configure, simple-to-use platform.

Compare Duo editions today to find the right plan for your security needs.

Try Duo for free Compare editions

A photo of a black hat employee presenting at a conference

Duo continuously adds more features to make the process simpler and more secure, and the culmination of that is Duo Directory providing identity for us that we know is secure. Duo is always there, it's always on, and it's ready for us every time we need to roll out a new Black Hat conference.

Read the case study

Steve Fink

Principal Architect, Black Hat

An office building for Inductive Automation

When we heard about Duo Directory we decided to move away from Active Directory and just put it all in Duo. We moved the whole company over a one-week period. It was as seamless as it could be.

Read the case study

Jason Waits

Chief Information Security Officer (CISO), Inductive Automation

Duo Directory FAQs

Can Duo Directory be used as a standalone cloud directory service?

Yes. Duo Directory can operate independently as a standalone cloud directory service, allowing you to create and manage users and groups directly in Duo without requiring on-premises directory infrastructure. Duo provides organizations a path to security-first IAM by combining directory, SSO, MFA, device trust, and access policy capabilities in a single platform.
Can Duo Directory support multiple identity directories simultaneously?

Yes. Duo Directory supports multiple identity sources and routing rules allowing organizations to direct different users to the proper authentication source. For example, employees can authenticate through Active Directory, while contractors, vendors, or other external users can be routed to authenticate through Duo Directory.
What identity sources can Duo Directory sync with?

Directory supports automatic sync from Microsoft Active Directory, Microsoft Entra ID, Okta via SCIM 2.0, Google, OpenLDAP, and any SCIM 2.0-compliant directory. You can also import users manually or from CSV. Outbound automated provisioning pushes users and groups into Microsoft 365, Google Cloud, and other SCIM-supported applications.
How does Duo Directory handle contractors and vendors?

Duo Directory runs side by side with your primary corporate directory as a dedicated identity store for external users. You create and manage contractor, vendor, and partner accounts directly in Duo, separate from your main directory. You apply specific access policies and enforce MFA the same way you would for employees. When an engagement ends, administrators can immediately deprovision the account, revoking access.
Do I need a separate Identity Governance (IGA) platform to handle Joiner, Mover, and Leaver (JML) workflows?

No, Duo Directory provides robust automated JML capabilities without the premium cost of a dedicated IGA platform. By utilizing SCIM automation and Directory Sync, Duo automatically updates user access based on your source directory. For movers and leavers, governance is strictly enforced. Users are blocked from Duo authentication immediately after the next directory sync detects their disabled or removed status in the source directory.
Do I have to replace my existing Active Directory or Okta to use Duo Directory?

No. Duo Directory is designed to work alongside your existing identity providers. It sits in front of your current IDPs as an identity broker, applying phishing-resistant MFA and adaptive policies, then passes authenticated users back. Your existing infrastructure stays intact. If you want to migrate away from an on-premises directory over time, Duo Directory can serve as a standalone replacement with migration tools built in.
How does Duo Directory work with existing Active Directory environments?

Duo Directory can integrate with Active Directory through Duo Directory Sync, which imports users, groups, and selected attributes into Duo. This one-way sync helps administrators use existing AD data for authentication, access policies, MFA, and lifecycle management while managing security controls in Duo.
How does Duo Directory complement existing Active Directory security solutions?

Duo Directory complements Active Directory security solutions by adding identity-first access protections such as phishing-resistant authentication, device trust, and adaptive access policies. Instead of replacing AD outright, Duo can help organizations apply stronger controls around the users and applications that depend on AD.
How does a Duo Active Directory integration reduce administrative overhead while maintaining security?

Establishing a Duo Active Directory integration allows you to seamlessly sync users, groups, and status changes from your on-premises infrastructure directly into the Duo platform so access policies stay aligned with directory changes. This reduces manual administration by automating user lifecycle management, supporting onboarding and offboarding workflows, and ensuring Duo authentication reflects current user status after directory sync.
Can administrators use Duo Directory to enforce stricter Active Directory security controls across all applications?

Duo Directory enables administrators to enforce robust Active Directory security controls by combining synced directory data, strong MFA, device trust, and access policies. By leveraging these Active Directory security controls, administrators can create granular access policies that automatically block access for deactivated users and ensure that only healthy, trusted devices can connect to sensitive corporate resources.