Current + Cisco Duo integration

Duo is the multi-factor layer in front of a partner's logins. Current's Duo integration is a view-only feed into the SBR/QBR module and the company alert band. It reads what Duo already knows about who is protected and who is not, and never writes back.

What the integration does

Current authenticates to Duo with a read-only Admin API application, walks your accounts, people, enrolled devices and recent sign-in activity every six hours, and stages the result as evidence for AI-assisted Strategic Business Reviews. Instead of opening the Duo Admin Panel the week of the review and counting by hand, the coverage numbers are already sitting on the company record when you open it.

What data flows

• Accounts — the partner roster, either your Duo subaccounts or the single account a credential covers, matched to your Current companies so every signal below lands on the right record.
• People — enrolment state, account status, when each person last signed in, and how many phones, hardware tokens and security keys they carry.
• Authenticator devices — platform, model, operating system and app version, and the screen lock, encryption and tamper state Duo reports for each one.
• Sign-in activity — granted, denied and fraud-reported counts per account per day, with a small tally of the reasons behind denials.

The feed is one-way. Current does not enrol people, issue bypass codes, remove authenticators, create administrators, change policy, or create and delete partner subaccounts. Those endpoints are not in the connector's code, so they cannot be reached by a bug either. Duo stays the place where identity changes happen; Current uses the evidence.

The number that starts a conversation

Multi-factor coverage is rarely the flat hundred percent a licence count implies. The gap is made of four situations, and one of them hides in plain sight: a person in bypass authenticates with their password alone while their account looks entirely healthy. Bypass gets granted for a broken phone or a migration and then stays granted, because nothing in a normal week surfaces it. Current counts people in bypass alongside those who are disabled, locked out, or never enrolled, and puts the total in front of the account manager. Three of your people can sign in without a second factor right now is a sentence that gets a meeting booked.

A feed about people, built to mirror as little as possible

Every other read-only feed in Current describes machines. This one describes employees, so it takes the minimum. It keeps a Duo username, a display name, an email address, enrolment and status, and counts of the authenticators a person carries. It does not read phone numbers, date of birth, custom attributes, aliases, notes, or anything about passwords. Sign-in activity is counted per day and nothing else survives — not the IP address on each event and not the city or country beside it. A daily denial count is what a review is built from; a location history is a liability with nothing on the other side of it. Partner viewers never reach any of it, and that is enforced at the database.

Unknown reads as unknown

Duo reports device hygiene as display strings with one documented positive value and an empty string as the alternative, and it does not say whether an empty string means the device has no screen lock or means the platform does not report one. Current counts what it can confirm and shows the denominator beside it, so a phone Duo said nothing about is never counted as a pass and never counted as a breach. The same rule runs through the rest of the feed: an unrecognised account status leaves that person's risk unknown rather than fine, and if a whole leg of a sync fails, the counts it would have produced read blank rather than zero. A coverage percentage built by treating silence as a pass is a percentage that collapses the first time a partner asks which people it covered.

One credential, every partner

An MSP running Duo for its partners manages them as subaccounts under a parent account. One read-only Admin API application on the parent, carrying the subaccount read permission, reaches every one of them — there is no key per partner to collect, rotate, or lose. A shop that runs Duo for a single organisation pastes the same three values and gets the same result with one account instead of forty. Current lists what the credential can see and links each account to a company by normalized name, leaving anything ambiguous for a person to decide rather than pairing it on a guess.

Alerts a salesperson can read

When a mapped company has people who can authenticate without a second factor, the company alert band raises an entry that names the count and the reason, not the product. It clears itself when the count returns to zero on a complete read. Someone standing in front of a partner needs to know that three of their people are exempt from multi-factor and that two of those are in bypass; they do not need to know which vendor reported it, and the alert is worded accordingly.

Where the data appears

• In Strategic Business Reviews, in the security posture chapter, as multi-factor coverage beside your other security evidence including KnowBe4 awareness results.
• On the company record, in the People section: enrolment percentage, the at-risk breakdown, the authenticator mix, device hygiene with its denominators, and stale accounts nobody has signed in to for ninety days.
• In dashboard metrics, including enrolment rate and at-risk counts, rolled up across your whole book.
• In the company alert band, when somebody at that company can sign in without a second factor.

Why it matters

Multi-factor is the control most partners believe is finished, because it was rolled out once and everybody remembers the rollout. An MSP running Duo for a partner like Northwind Traders can open the account and see that ninety-four of ninety-seven people are enrolled, that two of the remaining three are sitting in a bypass somebody granted eighteen months ago, that eleven people still fall back to SMS when a security key would cost less than a support ticket, and that six enabled accounts have not signed in since spring. Every one of those is a conversation with a number attached, and none of them required anyone to open a console the week of the review.