Configure Connection
Cisco Duo guide
Create an Admin API application, grant access for your process, and configure NIM to provision users and manage group access.
Before you beginDirect link to Before you begin
Follow the Cisco Duo Admin API documentation. You need a Duo account with Admin API access and an administrator with the Owner role to create or modify the application. A new 30-day Duo Advantage trial includes Admin API access.
NIM requires Tenant URL, Integration Key, and Secret Key.
Create the applicationDirect link to Create the application
- If needed, sign up for a Duo account with Admin API access.
- Sign in to the Duo Admin Panel and go to Applications > Application Catalog.
- Find Admin API and select + Add.
- Record the Integration Key, Secret Key, and API Hostname for the new application.
Treat the secret key as a password. Store it securely and do not share it through email or with unauthorized people.
Grant access for the intended operationsDirect link to Grant access for the intended operations
Use each endpoint's permission requirements in the vendor documentation to select the application's grants. For user and group provisioning, review Grant resource - Read and Grant resource - Write. If NIM will collect administrators, review Grant administrators - Read as well.
The available application permissions cover the following areas. A permission being available in Duo does not mean every associated operation is implemented by the NIM connector.
| Duo permission | Access it enables |
|---|---|
| Grant administrators - Read | Read administrators and administrative units. |
| Grant administrators - Write | Maintain administrators and administrative units. |
| Grant read information | Read account utilization. |
| Grant applications | Maintain integrations, including Admin API applications. |
| Grant settings | Read and change account settings. |
| Grant read log | Read authentication, offline access, telephony, and administrator action logs. |
| Grant resource - Read | Read end-user, policy, and device resources. |
| Grant resource - Write | Create, update, and delete supported resources. |
| Grant identity verification - Read | Read identity verification status. |
| Grant identity verification - Write | Start or cancel identity verifications. |
| Grant set Admin API permissions | Change grants on other Admin API applications through the API. |
MSP accounts and accounts that can create subaccounts can also configure Subaccount permissions. These include the corresponding administrator, information, application, settings, log, resource, identity verification, and API-permission grants for subaccounts, plus Grant accounts - Read/Write for subaccount administration and Grant user limits - Read/Write for hard user limits. Review the vendor's subaccount permission table when your process requires that scope.
Optionally restrict Networks for API Access to the NIM server's public egress IP addresses or ranges. Without a restriction, the application can be accessed from any network. If restrictions are configured, ensure the NIM server's actual egress address is included. Save the application configuration.
Enter the connection settingsDirect link to Enter the connection settings
- In NIM Studio, open Systems > Overview and add a Cisco Duo system, or select the existing system.
- Open Connection, enter the following settings, and save.
| NIM setting | Value |
|---|---|
| Tenant URL | The API Hostname from the Admin API application, using the format expected by the Connection screen. |
| Integration Key | The application's integration key, also called ikey. |
| Secret Key | The corresponding secret key, also called skey. |
Test user retrievalDirect link to Test user retrieval
-
Select Test Connection. NIM attempts to retrieve users using:
GET /admin/v1/users -
If the test fails, verify the Tenant URL, Integration Key, Secret Key, resource read grant, network access, and any Networks for API Access restrictions.
-
Collect users, groups, memberships, and any other data required by your process. Confirm that the expected records are present.
-
Validate identity and group mappings, then test intended user and membership changes with safe records before enabling automation.
The connection test checks user retrieval. Validate other collection permissions and each intended write operation separately.