The end-user experience depends on whether users are already enrolled in Duo Security before you configure it as a factor in Okta. Click Inactive in the upper right and select Activate.

Enter the values that you generated in Duo Security when you integrated with Okta:.

Click Edit beside Duo Security Settings.

In the Admin Console, go to Security > Multifactor. Record these values and save them for when you add Duo Security as a factor. Integration generates the following values: In Duo Security, integrate your Duo Security account with Okta.

End user settings in the Duo Mobile app.

Depending on your Okta integration settings in Duo Security, end users can enroll with a smartphone, tablet, telephone, Touch ID, and security keys. Users without an existing Duo Security enrollment can enroll themselves when they sign in to Okta, or through their Duo Security account page. You can change username mapping as described in this topic. When an end user signs in to Okta or accesses an Okta-protected resource, Okta looks up the user in your Duo Security account according to the user’s Okta username or email address. If you have a Duo Security deployment with existing enrollments, make sure that your Duo Security usernames match the Okta usernames or email addresses of your Okta users. When enabled as a factor, Duo Security is the system of record for MFA and Okta delegates secondary verification of credentials to your Duo Security account. You can add Duo Security as a multifactor authentication (MFA) option in Okta.

Add yubikey to duo