- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does Splunk Cloud support DUO two factor authentication? I am a cloud customer who is also a duo customer. I do not see the ability to add DUO under authentication methods.
Thanks in Advance!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is this really not possible with Splunk Cloud? Is there a workaround to get MFA working?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
While it is true that there is no direct support for 2FA (Duo) in Splunk Cloud anymore (it was removed after 6.6 I believe), the way to still achieve 2FA is to do it at the SAML/IDP layer. As long as your IDP supports 2FA and the 2FA bits happen outside of Splunk, go for it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Duo IDP is not supported in in Cloud b/c it cuts off local users needed for administration in Splunk Cloud. If DUO re-writes its IDP in the future it maybe possible.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can Splunk build in an option to enable Duo on an account basis instead of globally?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Yes, but the cloud instance needs to be at 6.5.x.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can Splunk please confirm that this is still a valid answer? My Splunk Cloud ver 7.2 does not appear to have any options for configuring Duo support.
This page https://docs.splunk.com/Documentation/Splunk/8.0.0/Security/AboutMultiFactorAuth clearly states
"Splunk Cloud does not support
multifactor authentication with Duo
Security."
which is a contradiction to this accepted answer.
If Duo is supported in Cloud 7.x/8.x please point us to the appropriate documentation.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


I downvoted this post because this answer is obsolete (and now wrong). see splunk internal engineering reference; spl-154283
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How do we find this document?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Much!
