---
title: "Response Actions for Cisco Duo"
slug: "response-actions-for-cisco-duo"
updated: 2026-09-09T16:09:40Z
published: 2026-09-09T16:09:40Z
canonical: "docs.redcanary.com/response-actions-for-cisco-duo"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Response Actions for Cisco Duo

The Zscaler MDR [Automation](/doc/docs/automation) interface provides the following response action for Cisco Duo:

**Update Duo User Status** This action allows you to set a user’s status to either Active or Disabled:

- **Active** - The user is enabled in Duo and can use two-factor authentication (2FA) to log in
- **Disabled** - The user is blocked from using Duo and can’t log in

> [!NOTE]
> Notes
> 
> - The Disabled status can’t be set for users who are managed by Active Directory or Entra ID sync
> - The Active status can’t be set for users who are disabled by directory sync
> - The status of admin accounts can’t be changed

## **Prerequisites**

- You previously set up a Duo Admin API application and know the **API Hostname**, **Integration Key**, and **Secret Key.** For more information, see [Integrate Cisco Duo with Zscaler MDR](/doc/docs/integrate-cisco-duo-with-red-canary).

## Adding Cisco Duo Response Actions to a Playbook

To add the Cisco Duo response action to an Automate playbook:

1. From the Zscaler MDR portal navigation menu, select **Automation > Playbooks**.
2. In the **Playbooks** section, open an existing Automate playbook or make a new one by clicking **+Create New Playbook**.
3. Assign or edit the playbook name and description, then click **+Add Action**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/duoresponse-1_01.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A24Z&se=2026-11-09T12%3A54%3A24Z&sr=c&sp=r&sig=ZljtbokdyG3nfIRFth8T%2BIbkaSZu2F6GBENCsnPpdE4%3D)
4. From the **Cisco Duo** section, add the required action to the playbook. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/duoresponse-1_02.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A24Z&se=2026-11-09T12%3A54%3A24Z&sr=c&sp=r&sig=ZljtbokdyG3nfIRFth8T%2BIbkaSZu2F6GBENCsnPpdE4%3D)
5. Choose the user status:

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/duoresponse-1_03.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A24Z&se=2026-11-09T12%3A54%3A24Z&sr=c&sp=r&sig=ZljtbokdyG3nfIRFth8T%2BIbkaSZu2F6GBENCsnPpdE4%3D)
  - **Active**
  - **Disabled**
6. Enter the **API Hostname**, **Integration Key**, and **Secret Key** from the Duo Admin API application you set up when you integrated Zscaler MDR with Duo. For more information, see [Integrate Cisco Duo with Zscaler MDR](/doc/docs/integrate-cisco-duo-with-red-canary) ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/duoresponse-1_04.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A24Z&se=2026-11-09T12%3A54%3A24Z&sr=c&sp=r&sig=ZljtbokdyG3nfIRFth8T%2BIbkaSZu2F6GBENCsnPpdE4%3D)
7. [OPTIONAL] Check the **Require Approval** box and provide contact details if you want someone to approve this action before it executes. This will apply to both manual and automatically-triggered executions. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/duoresponse-1_05.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A24Z&se=2026-11-09T12%3A54%3A24Z&sr=c&sp=r&sig=ZljtbokdyG3nfIRFth8T%2BIbkaSZu2F6GBENCsnPpdE4%3D)
8. Click **Save**.

## Manually Executing the Response Actions

To execute the Cisco Duo response actions manually:

1. Open the playbook and click **Run**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/duoresponse-1_06.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A24Z&se=2026-11-09T12%3A54%3A24Z&sr=c&sp=r&sig=ZljtbokdyG3nfIRFth8T%2BIbkaSZu2F6GBENCsnPpdE4%3D)
2. Search for the user identity in the dropdown list then click **Run**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/duoresponse-1_07.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A24Z&se=2026-11-09T12%3A54%3A24Z&sr=c&sp=r&sig=ZljtbokdyG3nfIRFth8T%2BIbkaSZu2F6GBENCsnPpdE4%3D)
3. Click the **Follow along…** link to view the results of the action. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/duoresponse-1_08.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A24Z&se=2026-11-09T12%3A54%3A24Z&sr=c&sp=r&sig=ZljtbokdyG3nfIRFth8T%2BIbkaSZu2F6GBENCsnPpdE4%3D) If you set the action to **Require Approval**, you’ll need to approve it before it can execute.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/duoresponse-1_09.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A24Z&se=2026-11-09T12%3A54%3A24Z&sr=c&sp=r&sig=ZljtbokdyG3nfIRFth8T%2BIbkaSZu2F6GBENCsnPpdE4%3D)

## Automatically Executing the Response Actions

To execute the Cisco Duo response actions automatically, link an appropriate trigger to the playbook. For more information, see [Customize When a Playbook is Run With Triggers](/doc/docs/customize-when-a-playbook-is-run-with-triggers).