Cloud Secure Edge Docs

CSE Home> Public Applications> Duo

Home

Learn Cloud Secure Edge

What is Cloud Secure Edge?

Get Started

Quickstart
Solutions
Platform Components

Secure Resources

Networks
Private Resources
Public Applications
- IP Allowlisted SaaS Apps
- IdP Federated SaaS Apps
Internet Traffic
Trust Scoring

Manage Access Policies

Access Policies
Content Policies
- Internet Threat Protection

Manage and Monitor Your Org

Manage Users and Devices
Manage Admins
Visibility and Logging

More Resources

Changelog
API Guide
Cloud Secure Edge Labs
Licenses
- Editions Licenses

Use IdP Federation to enforce zero trust policies on all SaaS Applications integrated with Duo

Add CSE as a SAML Identity Provider authentication source in Cisco Duo Single Sign-On so that all SaaS applications federated through Duo SSO are subject to CSE zero trust policy enforcement and Passwordless authentication

Updated On: Aug 13, 2026

Cloud Secure Edge Docs

Use IdP Federation to enforce zero trust policies on all SaaS Applications integrated with Duo

Overview #

Prerequisites #

How It Works #

Step 1: Create the SaaS (IDP-Routed) application in CSE and obtain CSE's SAML IdP metadata #

Step 2: Add CSE as a SAML Identity Provider authentication source in Duo #

Step 3: Preserve a break-glass path and prevent redirect loops #

Step 4: Route specific applications through CSE (phased rollout) #

Verify the Sign-In #

Step 5: Route all applications through CSE (global default source) #

Enable Passwordless Authentication #

Exempt Specific Users #

Exempt Non-SaaS Applications #

Avoid Duplicate MFA Prompts #

Expected Behaviour #