> ## Documentation Index
> Fetch the complete documentation index at: https://helpdocs.getthread.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Liongard Duo Read

> Answer Duo MFA posture questions from the Liongard Duo inspector — enrollment coverage, bypass users, admin list, and protected-integration inventory — for coverage audits and QBR evidence.

<Info>
  **Category:** Liongard Inspectors · [View source ↗](https://github.com/bryan-getthread/skills/blob/main/skills/liongard-inspectors/liongard-duo/SKILL.md)
</Info>

**Connectors:** `Liongard`

**Role:** [Technician](/start-here/roles/technician)

**Outcome:** Risk & Compliance, Faster Resolution & Response

**When to use:** "What's Duo enrollment coverage at \<client> / who still isn't enrolled?", "any users in bypass status?", "who are the Duo admins / which apps are behind Duo?", or feeding MFA-coverage numbers to a posture review, QBR, or insurance questionnaire.

**Run it:** on one client — name the client and the Duo question.

## Prompt

```
Answer a Duo posture question for CLIENT_NAME from the Liongard Duo inspector. Read-only — enrollment pushes, bypass revocation, and admin changes are technician actions.

1. Find the Duo inspector for this client and confirm it ran recently; date the data.
2. Read the values from its latest dataprint, verifying every field angle against the live dataprint before trusting a zero:
   - Enrollment coverage → users by status: active-enrolled, pending/not-enrolled, disabled, bypass. Coverage percent = enrolled / active users, and the denominator matters: reconcile the Duo user count against the directory source (the AD or M365 read) — a 100% Duo enrollment over half the workforce is a 50% finding. Never report coverage percent without naming the denominator and its source.
   - Bypass users → every account in bypass is a standing MFA hole; for each, cross-check ticket history for the authorizing request and its intended expiry. Bypass with no ticket, or past its stated window, is a flagged finding. Bypass findings are never softened.
   - Admins → the Duo administrator list, each explainable; Duo admins can weaken MFA for everyone, so unexplained entries escalate.
   - Integrations → the protected-application inventory (VPN, RDP gateways, M365, LDAP) read against the client's documented stack — the gap list is usually the QBR's most actionable slide.
   - Changes → check what changed for new bypass grants, admin additions, integration changes.
   - Open-ended → ask in plain language, verified before reporting.
3. Output: coverage numbers with both numerator and denominator stated, bypass and admin findings flagged first, integration gap list, data as-of timestamp. Leave a plain-text note on request. Degradation: no Duo inspector → answer from directory-side MFA data and tickets, labeled "Duo not instrumented — coverage from directory view only."
```


## Related topics

- [Liongard Okta Read](/skill-library/liongard-inspectors/liongard-okta.md)
- [Liongard Azure Read](/skill-library/liongard-inspectors/liongard-azure.md)
- [Liongard AWS Read](/skill-library/liongard-inspectors/liongard-aws.md)