New users

[nickpsh]

Good afternoon,

We enforce Cisco Duo via AD.  When a new user is created and they try to sign in to Gmail; it expects Cisco duo but they haven't configured that yet.  We don't want to put each personal manually into bypass until they are signed up.  How do you work around this issue?  Thanks!

[DuoKristina]

If you've chosen to protect your email with Duo then you can't have them use emailed enrollment links for their first-time registration without allowing access to the mail system without 2FA.

If you are protecting Google Workspace with Duo then you must have deployed Duo SSO using Active Directory authentication, and then federated Google to Duo? If so, consider enabling Duo Central for Duo SSO. Your users can visit the Duo Central URL (https://yourssodomain.login.duosecurity.com/central), log in with their AD creds, and complete first-time Duo enrollment there.

If you aren't using Duo SSO, how have you integrated Duo with Gmail?