Duo integration
Unify MFA device lifecycle and authentication intelligence to enforce zero-trust access controls and security incident response.
What it connects
- User accounts with MFA enrollment status, enrolled devices, and credential types.
- Administrator audit logs showing user provisioning, group changes, and access control modifications.
- Authentication attempt logs with success/failure results, authentication methods, and device context.
- MFA device inventory including phones, hardware tokens, and their assignment to users.
What it automates
- Create and update Duo user accounts with group assignment for automated onboarding and offboarding.
- Generate one-time bypass codes for locked-out users and provision hardware tokens for new hires.
- Remove MFA devices when employees depart or swap authentication methods.
- Monitor and resync hardware tokens to maintain zero-trust compliance.
In practice
- A new hire ticket triggers user creation in Duo, assignment to security groups based on role, and enrollment of both push authentication and hardware token backup.
- During offboarding. STLabs removes the departing user's phone and tokens from Duo, revokes bypass codes, and updates group membership to block access.
- Helpdesk tickets requesting MFA resets are validated for approval, then STLabs generates bypass codes and sends SMS activation links to restore user access within audit controls.
- Authentication logs are correlated with incidents: 15+ failed Duo pushes in 10 minutes triggers a security ticket with the attacker IP, user, and time window for investigation.
