SeatReaper reads every Duo user in your clients' Duo accounts, with their status and last login. It never changes users, policies or applications.
Duo bills every user except those pending deletion. Disabled users still count, so a person who left and was only disabled in Duo is still on the bill.
Create the application
Duo for MSPs (one parent account with a child account per client):
- In the parent account's Duo Admin Panel, open Applications, choose Protect an Application, and add Accounts API.
- Copy the integration key, the secret key and the API hostname (such as api-xxxxxxxx.duosecurity.com).
A single Duo account (no child accounts):
- In the Duo Admin Panel, open Applications, choose Protect an Application, and add Admin API.
- Give it only the Grant read resource permission.
- Copy the integration key, secret key and API hostname.
Connect
An owner opens Settings > Integrations > Duo, pastes the API hostname, integration key and secret key, and chooses Connect Duo. SeatReaper checks which kind of application it is (shown on the card), saves the secret key encrypted, and runs the first sync. After that it syncs every day, and Sync now checks at any time. SeatReaper only sends requests to Duo API hosts.
How users are linked to clients
- With Duo for MSPs, each child account is linked to the client with the same name (ignoring capitals, punctuation and endings like Inc or LLC), or to the client an owner or tech picks under Duo accounts. A picked link is kept on every sync.
- A single account is one entry under Duo accounts: pick its client.
- Inside a client, each Duo user is matched to a Microsoft 365 user by email (or by username when it is an email address).
What SeatReaper does with it
- People who left: when a Microsoft 365 user is blocked, or has not signed in for the inactive threshold, and still has a Duo user, the Duo user is added to that person's item as another charge. See What SeatReaper flags.
- Not in Microsoft 365: a Duo user whose email is in the client's Microsoft 365 domains but who has no Microsoft 365 account is flagged.
- Offboarding: Duo users appear when you offboard someone, and are confirmed once they are gone from Duo or pending deletion.
- Prices: set your monthly cost per Duo user in the price book.
Clients that do not use Microsoft 365, or are not connected to it, get no Duo items yet: SeatReaper needs Microsoft 365 to tell who has left.
Disconnect
An owner chooses Disconnect on the card. SeatReaper deletes the Duo accounts and users it synced. Delete the application in the Duo Admin Panel to revoke access completely.
In compliance reports
On Growth and Pro, the Access review in the compliance evidence reports lists blocked Microsoft 365 accounts that still have a Duo user.