Setting up Duo

Duo provides the second factor for internal staff. ReportMesh runs it itself, immediately after Entra sign in: a person enters their work credentials, Entra returns them to the portal, and the portal then sends them to Duo before letting them in.

Who this is for: Whoever is standing the portal up. You need an administrator account on the Duo Admin Panel.

Prerequisite: Entra ID, because Duo runs after it.

On the other way of doing this

Duo can instead be wired into Entra itself, as an external authentication method enforced by a Conditional Access policy. That approach requires Entra ID P1 or P2 licences.

ReportMesh does not work that way. It runs the Duo step in the application, which needs no P1 or P2 licences and no Conditional Access policy. Configure what this page describes.

Create the Duo application

1. Sign in to the Duo Admin Panel.

2. Applications → Protect an Application.

3. Find Web SDK in the list and select Protect.

   Choose Web SDK, not the Microsoft connector

   Duo offers a pre-built "Microsoft Entra ID" connector. That one federates Duo into Entra itself, which is the design ruled out above. ReportMesh speaks to the Web SDK application directly.

4. Record the three values the page shows: the Client ID, the Client secret, and the API hostname.

   The API hostname is the bare hostname, something like api-xxxxxxxx.duosecurity.com. Record it without an https:// prefix and without a trailing slash. ReportMesh adds the scheme itself, and a prefixed value causes Duo to reject the request before anyone is prompted.

5. Set the redirect URI to https://<your-portal-hostname>/duo-callback — the portal's hostname, the same one Entra redirects to, not the API hostname.

Enrol a test user

Enrol at least one person in Duo before testing anything.

Without this, sign in succeeds against Entra and then fails at the second factor, which is a confusing way to discover the problem. The full sign-in path cannot be tested until the portal is deployed and running.

The two MFA settings

Two settings in the application's configuration look similar and do different things:

Setting	Meaning
Require Duo MFA	Run the Duo step after Entra sign in. This is the flow described here.
Require an MFA claim	Additionally demand that the Entra token itself proves MFA already happened.

The second is for organisations enforcing MFA inside Entra through Conditional Access, where the token carries proof of it. Turning both on demands MFA twice, from two systems. Turning both off removes the second factor entirely.

For the setup on this page, the first is on and the second is off.

Checklist

• The Duo application is of type Web SDK.
• The API hostname carries no https:// prefix and no trailing slash.
• The redirect URI is on the portal's hostname and ends /duo-callback.
• At least one test user is enrolled, with a working authenticator.
• All three Duo values are in a password manager.

Common problems

What you see	What it usually means
Entra sign in completes, then a blank page or an error	The Duo redirect URI does not match the configured one, or points at the API hostname instead of the portal's.
Duo rejects the request before anyone is prompted	The API hostname includes a scheme. Strip the https://.
No Duo prompt appears and the user lands signed in	The Duo requirement is not switched on in the application's configuration.

Next

Setting up Cognito, if external guests are in scope. If they are not, move on to Granting Power BI workspace access and Granting SharePoint site access.