Duo integrates with your Cisco ISE to add two-factor authentication.
The Cisco ISE instructions support push, phone call, or passcode authentication. This configuration does not feature the interactive Duo Prompt for web-based logins, but does capture client IP information for use with Duo policies, such as geolocation and authorized networks.
Read the Duo documentation for this integration at https://duo.com/docs/ciscoise-radius.