Last updated: September 1, 2026

Using Duo with RoundUp

RoundUp Early Childhood is the software a child care center runs on — enrollment, attendance and ratios, billing, and family communication. Staff sign in to it with their work identity, and this guide is for the Duo administrator who wants that sign-in protected by Cisco Duo.

The main path is section 2: connect Duo Single Sign-On as the identity provider your staff sign in with. If Duo is instead sitting in front of a directory you already had — Microsoft Entra ID, Okta, Auth0, JumpCloud — read section 3 instead, which is shorter, because there is nothing to configure in RoundUp.

Contents

  1. Which setup applies to you
  2. Connecting Duo Single Sign-On
  3. If Duo already protects another identity provider
  4. What Duo controls, and what stays in RoundUp
  5. When someone leaves
  6. Troubleshooting
  7. Support

1. Which setup applies to you

RoundUp does not hold Duo credentials and does not call the Duo API. Staff authenticate at your organization's identity provider, and RoundUp accepts the result. So the question is simply where Duo sits in your own identity stack:

Both are legitimate finished states, and a center can move from the second to the first later without losing anything: staff, roles and history all live in RoundUp, not in the connection.

2. Connecting Duo Single Sign-On

Duo Single Sign-On can act as an OpenID Connect provider in its own right, authenticating your staff against on-premises Active Directory or a SAML identity provider behind it. RoundUp connects to it as a generic OpenID Connect relying party.

Before you start

Set aside about twenty minutes, and do it outside pickup hours — you will sign yourself out at least once while testing.

Step 1 — Get the two URLs RoundUp gives you

In RoundUp, open Marketplace → Single sign-on (SSO). The Connect single sign-on screen shows two values with tap-to-copy buttons:

Read both from that screen rather than from this page. They are generated for your center, and the host can change as our infrastructure moves.

Step 2 — Add the application in Duo

Duo's own reference for this application type is Duo Single Sign-On for Generic OIDC Relying Parties. The steps below are that process with RoundUp's values filled in.

  1. In the Duo Admin Panel, go to Applications → Application Catalog, find Generic OIDC Relying Party (it carries the "SSO" label), and choose Add.
  2. On the General tab, set Grant Type to Authorization Code. Leave Allow PKCE only authentication unchecked — RoundUp exchanges the code server-side with a client secret, so a PKCE-only application will not complete sign-in.
  3. Paste the Redirect / callback URI from step 1 into Sign-In Redirect URLs.
  4. On the Scopes tab, make sure openid, profile and email are enabled, with email mapped to the attribute holding the person's work address. RoundUp reads the signed-in person's name and email address and nothing else.
  5. Under User access, assign the Duo groups whose members should be able to sign in to RoundUp.
  6. Rename the application if you like — this is the name your staff see in Duo, not in RoundUp — then Save.
  7. Open the Metadata tab and copy the Client ID, the Client Secret and the Issuer.

Step 3 — Paste Duo's details into RoundUp

Back on the Connect single sign-on screen, fill in:

Choose Connect single sign-on. Saving validates before it stores: RoundUp checks that the discovery document's own issuer matches what you entered, that its endpoints are HTTPS on the same origin, and that it signs with RS256. A mistyped issuer fails here, naming what was wrong, rather than saving cleanly and failing at 7am when staff try to clock in.

Step 4 — Test, then roll out

  1. Choose Test sign-in. This runs the whole round trip against Duo — the authorization request, the token exchange, ID-token verification and the return into the app. A pass proves the connection genuinely works; it does not yet change anything for your staff.
  2. Tell your staff. From here they see Sign in with Duo on the RoundUp sign-in screen and complete Duo's prompt as they do for your other applications.
  3. Keep one Director able to sign in with a RoundUp password for a few days. If the client secret is reset in Duo or the application is changed, that account is how you get back in to fix it.

3. If Duo already protects another identity provider

When Duo protects your identity provider, it protects RoundUp automatically. A teacher opening RoundUp is redirected to your provider, meets whatever Duo policy you have set there, and returns to RoundUp already verified. RoundUp is not involved in that decision and cannot weaken it.

This means your existing Duo policies — device trust, group policies, the Universal Prompt, bypass and lockout behavior — apply to RoundUp on the day you connect single sign-on, without RoundUp-specific configuration. It also means that if you tighten a policy later, RoundUp tightens with it.

Set this up in Duo's own documentation rather than here, since it is a change to your directory and not to RoundUp:

Then connect that provider to RoundUp the normal way: Okta and JumpCloud have their own guides, and any other provider connects through the single sign-on setup described in the next section — the steps are the same, with your provider's values instead of Duo's.

4. What Duo controls, and what stays in RoundUp

Signing in never creates an account

RoundUp does not do just-in-time provisioning. Someone who authenticates through Duo but has no staff account at your center is refused, and told to ask their director. Accounts are created by an invitation in RoundUp — never by a sign-in.

This is deliberate, and it is the one thing worth understanding before you assign a large Duo group to the application: a directory identity on its own does not open access to children's records. Assigning fifty people in Duo grants nothing until those people have staff accounts in RoundUp.

Duo decides who; RoundUp decides what

Duo authenticates the person and enforces your policies. What that person can then see — the roster, family contact details, photos, messages, billing — is governed by their role in RoundUp, set by someone who already holds that access at your center. A job title arriving from your directory never grants permissions on its own.

What RoundUp holds

Your center's own Duo application credentials: the issuer, client id, and an encrypted client secret, scoped to your center. RoundUp holds no Duo administrative API keys, cannot enroll or modify your Duo users, and cannot change your policies. Staff sign-in identity flows to your Duo tenant under your own agreement with Cisco — RoundUp adds no intermediary between the two.

5. When someone leaves

Removing a person in Duo stops them authenticating, which stops them signing in to RoundUp. It does not by itself close their RoundUp account — deactivate them in RoundUp as well, which ends their access and signs out any session still open on a shared classroom tablet.

Their historical records stay intact and attributed: the incident reports they filed and the check-ins they recorded remain, because a licensor may ask for them.

6. Troubleshooting

"No account is linked to that email. Ask your director to invite you first."

Duo authenticated them successfully and RoundUp has no staff account for that address. Either they have not been invited yet, or the email Duo sent differs from the one on their RoundUp staff record. Check the email first — it is almost always the email.

"Your identity provider didn't provide an email to sign in with."

The email scope is disabled on the Duo application, or its claim is mapped to an attribute that is empty for this user. Fix the mapping on the Scopes tab and have them try again.

Saving the issuer fails

The message names the field that failed. Most often the Issuer was copied from the wrong row of the Metadata tab — the Discovery URL rather than the Issuer. Enter the Issuer; RoundUp appends the discovery path itself.

Sign-in returns to Duo with a redirect-URI error

The Sign-In Redirect URLs field in Duo does not exactly match the Redirect / callback URI on the RoundUp screen. Copy it again with the tap-to-copy button — trailing characters and a missing path segment are the usual causes.

Staff do not see a "Sign in with Duo" button

The connection saved but has not been completed, or single sign-on is not yet switched on for your center. RoundUp deliberately falls back to the password step rather than showing a button that dead-ends. If Test sign-in passes and the button is still missing, email us.

7. Support

For help with a connection that will not complete, include your center name and the exact message shown on screen. For questions about Duo itself — policies, enrollment, the authentication source behind Duo Single Sign-On — Cisco's documentation and support are the right place.