Background

For MSP Partners that have Duo Authentication installed as a 2 Factor Authentication method on their Customer's Systems.  Integrating with Quickpass Just in Time Accounts (JIT) will take some additional configuration to ensure that the JIT Account created will be authorized to work with Duo Authentication.

Example Video of the Process

Prerequisites

• Quickpass Tenant includes QGuard (Administrator and Service Account management)
• Login role Primary or Super has enabled JIT for their team via this KB
  https://support.getquickpass.com/hc/en-us/articles/14473398505367-How-to-create-and-use-Just-In-Time-Privileged-accounts
• Duo Authentication for Windows installed on the system in question
  
  
• Duo Users (technicians) are configured for Push/2 Factor Authentication
  • Due to an 8 Alias limitation for Duo, Quickpass recommends using the SAME JIT account name for all Customers that a JIT account will be used with.

Setup of Duo Authentication

Preparation - Quickpass Desktop App

1. In the Quickpass Desktop Application open the JIT account creation section.
   
2. Click the "Create JIT Account" button.
   
3. A window will open to select the initial configuration options for that customer.
4. Check the Default JIT Username box - this is the value that will be used within Duo.
   
   1. The Username value can be changed by the technician, however whatever name is chosen should be consistent with all other Customer JIT accounts.
      
5. Complete the creation of the JIT account following the process in the KB
   https://support.getquickpass.com/hc/en-us/articles/14473398505367-How-to-create-and-use-Just-In-Time-Privileged-accounts

Preparation - Duo Users

1. Login to the Duo Admin Dashboard
   
   
2. Select the Users section to find the Technician(s) that will be using JIT
   
3. Select the User from the list.
4. Look for the Username Aliases section and click the "+ Add a username Alias" link
   1. Add the JIT account name that was selected from the Preparation - Quickpass Desktop App phase (4.1) above. 
      1. NOTE: that this section only allows up to 8 Aliases.  This is why it is important to use the same JIT account name across all of your customers.
         
   2. Do not include the Active Directory Domain or UPN extension.
   3. Click Save Changes.
      

Testing

1. On a system that is setup with Duo Authentication for Windows (Domain Controller or Server/Workstation joined to traditional Active Directory) login with the JIT Credentials (either via the Autofill option on the Desktop App for ScreenConnect/ConnectWise Control, or by Copy/Paste with another remote control utility). 
   

   Desktop App w/Screenconnect	Copy/Paste

2. After the initial login credentials are populated the Duo Authentication prompt (or if automatically Push) should appear.
   
3. On the Mobile Device (or via the predetermined Duo Authentication options) accept the Push or enter the MFA code supplied.
4. The account should then complete the login process.