Last updated: September 17, 2026

Using Duo with RoundUp

RoundUp Early Childhood is the software a child care center runs on — enrollment, attendance and ratios, billing, and family communication. Staff sign in to it with their work identity, and this guide is for the Duo administrator who wants that sign-in protected by Cisco Duo.

The main path is section 2: connect Duo Single Sign-On as the identity provider your staff sign in with. If Duo is instead sitting in front of a directory you already had — Microsoft Entra ID, Okta, Auth0, JumpCloud — read section 3 instead, which is shorter, because there is nothing Duo-specific to configure in RoundUp.

Contents

  1. Which setup applies to you
  2. Connecting Duo Single Sign-On
  3. If Duo already protects another identity provider
  4. What Duo controls, and what stays in RoundUp
  5. Passwords stop working
  6. When someone leaves
  7. Troubleshooting
  8. Support

1. Which setup applies to you

RoundUp does not hold Duo credentials and does not call the Duo API. Staff authenticate at your organization's identity provider, and RoundUp accepts the result. So the question is simply where Duo sits in your own identity stack:

Both are legitimate finished states, and a center can move from the second to the first later without losing anything: staff, roles and history all live in RoundUp, not in the connection.

2. Connecting Duo Single Sign-On

Duo Single Sign-On can act as an OpenID Connect provider in its own right, authenticating your staff against on-premises Active Directory or a SAML identity provider behind it. RoundUp connects to it as a generic OpenID Connect relying party.

Before you start

Set aside about twenty minutes, and do it outside pickup hours — you will sign yourself out at least once while testing.

Step 1 — Get the two URLs RoundUp gives you

In RoundUp, open Marketplace → Single sign-on (SSO). The Connect single sign-on screen shows two values with tap-to-copy buttons:

Read both from that screen rather than from this page. They are generated for your center, and the host can change as our infrastructure moves.

Step 2 — Add the application in Duo

Duo's own reference for this application type is Duo Single Sign-On for Generic OIDC Relying Parties. The steps below are that process with RoundUp's values filled in.

  1. In the Duo Admin Panel, go to Applications → Application Catalog, find Generic OIDC Relying Party (it carries the "SSO" label), and choose Add.
  2. On the General tab, set Grant Type to Authorization Code. Leave Allow PKCE only authentication unchecked — RoundUp exchanges the code server-side with a client secret, so a PKCE-only application will not complete sign-in.
  3. Paste the Redirect / callback URI from step 1 into Sign-In Redirect URLs.
  4. On the Scopes tab, make sure openid, profile and email are enabled, with email mapped to the attribute holding the person's work address. RoundUp reads the signed-in person's name and email address and nothing else.
  5. Under User access, assign the Duo groups whose members should be able to sign in to RoundUp.
  6. Rename the application if you like — this is the name your staff see in Duo, not in RoundUp — then Save.
  7. Open the Metadata tab and copy the Client ID, the Client Secret and the Issuer.

Step 3 — Paste Duo's details into RoundUp

Back on the Connect single sign-on screen, fill in:

Choose Connect single sign-on. Saving validates before it stores: RoundUp checks that the discovery document's own issuer matches what you entered, that its endpoints are HTTPS on the same origin, and that it signs with RS256. A mistyped issuer fails here, naming what was wrong, rather than saving cleanly and failing at 7am when staff try to clock in.

Step 4 — Test, then roll out

  1. Choose Test sign-in. This runs the whole round trip against Duo — the authorization request, the token exchange, ID-token verification and the return into the app. A pass proves the connection genuinely works. Staff are switched to Duo as soon as the connection saves, not when the test passes, so run it straight away.
  2. Tell your staff. From here they see Sign in with Duo on the RoundUp sign-in screen and complete Duo's prompt as they do for your other applications.
  3. Know that passwords stop working. Once single sign-on is connected, every staff account at the center, directors included, signs in through Duo and RoundUp password sign-in is refused (families are unaffected). If the client secret is reset in Duo, enter the new one in RoundUp straight away; if a change ever stops everyone signing in, email support@roundupece.com.

3. If Duo already protects another identity provider

When Duo protects your identity provider, it protects RoundUp automatically. A teacher opening RoundUp is redirected to your provider, meets whatever Duo policy you have set there, and returns to RoundUp already verified. RoundUp is not involved in that decision and cannot weaken it.

This means your existing Duo policies — device trust, group policies, the Universal Prompt, bypass and lockout behavior — apply to RoundUp on the day you connect single sign-on, without RoundUp-specific configuration. It also means that if you tighten a policy later, RoundUp tightens with it.

Set this up in Duo's own documentation rather than here, since it is a change to your directory and not to RoundUp:

Then connect that provider to RoundUp the normal way: Okta and JumpCloud have their own guides, and any other provider connects through the single sign-on setup described in section 2 — the steps are the same, with your provider's values instead of Duo's.

4. What Duo controls, and what stays in RoundUp

Signing in never creates an account

RoundUp does not do just-in-time provisioning. Someone who authenticates through Duo but has no staff account at your center is refused, and told to ask their director. Accounts are created by an invitation in RoundUp — never by a sign-in.

This is deliberate, and it is the one thing worth understanding before you assign a large Duo group to the application: a directory identity on its own does not open access to children's records. Assigning fifty people in Duo grants nothing until those people have staff accounts in RoundUp.

Duo decides who; RoundUp decides what

Duo authenticates the person and enforces your policies. What that person can then see — the roster, family contact details, photos, messages, billing — is governed by their role in RoundUp, set by someone who already holds that access at your center. A job title arriving from your directory never grants permissions on its own.

What RoundUp holds

Your center's own Duo application credentials: the issuer, client id, and an encrypted client secret, scoped to your center. RoundUp holds no Duo administrative API keys, cannot enroll or modify your Duo users, and cannot change your policies. Staff sign-in identity flows to your Duo tenant under your own agreement with Cisco — RoundUp adds no intermediary between the two.

5. Passwords stop working

Once Duo Single Sign-On is connected, your staff can no longer sign in with a RoundUp password — you and every other director included. The sign-in screen offers the Duo button and the password field stops being an alternative.

That is the point of connecting it. If a password still worked, every account Duo was meant to stand in front of would keep a second way in that your policies never see. Parents and classroom kiosk devices are unaffected: parents have no account in your Duo tenant, and a shared tablet cannot complete a browser sign-in.

Staff you have already invited do not need to open their invite email first — their first Duo sign-in activates the account.

If Duo stops working

With everyone signing in through Duo, a broken connection means nobody at the center can sign in, including whoever would disconnect it.

Most failures fix themselves. If the client secret expires or is rotated in Duo, RoundUp notices the first time Duo refuses a sign-in for that reason and puts your center back on passwords until you paste in the new secret. Nothing to ask for, and staff keep working meanwhile.

For anything else, ask us to open a window. Some breakages look healthy from our side — a policy that now blocks everyone, staff unassigned from the application, a changed redirect URL. Email support@roundupece.com; we re-enable password sign-in for your center for a few hours so you can get in and fix the connection, and the window ends by itself.

6. When someone leaves

Removing a person in Duo stops them authenticating, which stops them signing in to RoundUp. It does not by itself close their RoundUp account or end a session already open on a shared classroom tablet: Duo Single Sign-On signs people in but does not provision them. Email support@roundupece.com to end their access to your center — once that's done, any session they have open is signed out within about a minute — and in the meantime sign them out of shared devices yourself.

Their historical records stay intact and attributed: the incident reports they filed and the check-ins they recorded remain, because a licensor may ask for them.

7. Troubleshooting

"No account is linked to that email. Ask your director to invite you first."

Duo authenticated them successfully and RoundUp has no staff account for that address. Either they have not been invited yet, or the email Duo sent differs from the one on their RoundUp staff record. Check the email first — it is almost always the email.

An invitation that was sent and never opened is not this problem: that account signs in through Duo and is activated by doing so. If they see this message, compare the two addresses character by character.

"Your identity provider didn't provide an email to sign in with."

The email scope is disabled on the Duo application, or its claim is mapped to an attribute that is empty for this user. Fix the mapping on the Scopes tab and have them try again.

Saving the issuer fails

The message names the field that failed. Most often the Issuer was copied from the wrong row of the Metadata tab — the Discovery URL rather than the Issuer. Enter the Issuer; RoundUp appends the discovery path itself.

Sign-in returns to Duo with a redirect-URI error

The Sign-In Redirect URLs field in Duo does not exactly match the Redirect / callback URI on the RoundUp screen. Copy it again with the tap-to-copy button — trailing characters and a missing path segment are the usual causes.

Staff do not see a "Sign in with Duo" button

The connection saved but has not been completed, or single sign-on is not yet fully provisioned on our side — the connect screen says so when that is the case. RoundUp deliberately falls back to the password step rather than showing a button that dead-ends. If Test sign-in passes and the button is still missing, email us.

The whole center is being asked for a password again

That is RoundUp telling you the Duo connection has stopped working — usually a client secret that expired or was rotated. Your staff can keep working on their passwords while you re-enter it; the button returns once the credential is good again.

8. Support

For help with a connection that will not complete, include your center name and the exact message shown on screen. For questions about Duo itself — policies, enrollment, the authentication source behind Duo Single Sign-On — Cisco's documentation and support are the right place.