# Integrating SailPoint with Duo SaaS

Connecting SailPoint to your Duo system allows you to manage the Duo user accounts. This guide is designed to give specific information about the requirements and field definitions needed to getting a working instance of Duo SaaS.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Duo connector supports the following features.

> [!NOTE]
>
> The Duo accounts include Duo users and Administrators. The Duo source supports Password Management for Duo administrators only. Before you can use any item marked with an asterisk (\*), SailPoint must activate the feature for your site.

### Account Management

Manages Duo Users and Administrators as accounts.

**For Duo Users**

- Aggregation, Refresh Accounts
- Create, Update, Delete
- Enable, Disable, Unlock
- Add/Remove Entitlement
- Add/Remove Phone Attribute: `phone_type` and `phone_platform`

**For Duo Administrators**

- Aggregation, Refresh Accounts
- Enable, Disable
- Create, Update, Delete
- Add/Remove Associated Administrative Units

### Account - Group Management

- Aggregation

  > **Note**
  >
  > By default, the Duo Administrator with the Owner role is enabled.
- Supports Administrative Unit as a group object. For more information, refer to [Administrative Unit Group Attributes](<https://documentation.sailpoint.com/connectors/duo/saas/help/schema.html#default-administrative-unit-group-attributes>).

### Activity Insights

Activity Insights supports activity from Duo and its associated accounts. This allows you to gather account information and activity data from Duo.

> [!IMPORTANT]
>
> Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on configuring Activity Insights, refer to Activity Insights Settings.

For more information on features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

## Prerequisites

- Create an Admin API integration. This generates an Integration Key and Secret Key that is required for Duo configuration. For more information, refer to [Connection Settings](<https://documentation.sailpoint.com/connectors/duo/saas/help/connecting.html#connection-settings>).

## Required Permissions

> [!NOTE]
>
> You must have the Owner role to create or modify an API application within the Duo Admin panel.

Sign in as an administrator user to the [Duo Administrator Panel](<https://admin.duosecurity.com/>). Ensure that the administrator creating the new Administrator API integration has the following permissions:

When **Manage Administrator Users** is enabled:

- Grant Administrators
- Grant Read Resource
- Grant Write Resource

When **Manage Administrator Users** is not enabled:

- Grant Read Resource
- Grant Write Resource

> [!NOTE]
>
> For read only operations, the `Grant Write Resource` permission is not required.

### For Activity Insights

An administrator requires the following permission to utilize Activity Insights:

| Scope | Description |
| --- | --- |
| Grant read log | The Admin API application can read authentications, offline access, telephony, and administrator action log information. |

For more information on configuring Activity Insights, refer to [Activity Insights Settings](<https://documentation.sailpoint.com/connectors/duo/saas/help/connecting.html#activity-insights-settings>).