Duo Security | Parent Inspector Not Discovering Child Inspector(s)

Overview ✨

A Duo Security Parent Inspector may complete successfully in Liongard while still failing to discover Duo child accounts or subaccounts. This commonly occurs after Duo's deprecation of the legacy Accounts API and the transition of MSP sub-account access to the Admin API.

Liongard has updated the Duo Parent Inspector to support Duo’s Admin API model following the deprecation of the legacy Accounts API. New and existing configurations should use the Admin API credentials and the appropriate MSP sub-account permissions for child-account discovery.

This article provides a support-ready outline for troubleshooting cases where a Duo Security Parent Inspector runs successfully but does not discover expected child accounts in an MSP environment.

⚠️ Use this guidance only for Duo MSP Parent accounts. If the Duo tenant is not an MSP Parent account, sub-account permissions will not be available and child discovery will not work.

When This Issue Applies

The Duo Parent Inspector runs without an obvious authentication failure.
Expected child accounts do not appear in discovered systems.
The Duo tenant is an MSP Parent account.
New Accounts API credentials cannot be created in Duo.

Likely Causes

Required Admin API permissions are missing.
Required sub-account permissions are missing.
Grant accounts → Read is not enabled.
The Admin API Integration Key or Secret Key is incorrect.
The API Hostname does not match the Admin API application.
Cached inspection data remains after configuration changes.
The Duo Parent account does not have access to the expected subaccounts.

Steps To Resolve

1. Verify the Duo Admin API application

In the Duo Admin Panel, navigate to Applications → Application Catalog and open the Admin API application used by the Liongard Parent Inspector.

Duo value	Liongard field
Integration Key	Admin Integration Key
Secret Key	Admin Secret Key
API Hostname	API Hostname

🗒️ Do not attempt to create a new Accounts API integration. Duo no longer permits new Accounts API integrations. MSP sub-account functionality is now handled through the Admin API

2. Verify Parent Admin API permissions

Within the Admin API application, review the main permissions section. For Liongard inspection, read access is generally sufficient and unnecessary write access should be avoided.

Permission	Recommended configuration
Grant administrators	Read
Grant read information	Enabled
Grant settings	Enabled
Grant read log	Enabled
Grant resource	Read

3. Verify MSP sub-account permissions

In the same Admin API application, scroll to Sub-account permissions. These settings determine what the Parent Admin API integration can access within associated Duo subaccounts.

⚠️ The most important permission for child discovery is Sub-account permissions → Grant accounts → Read. Without it, the Parent Inspector may be unable to enumerate subaccounts.

Sub-account permission	Recommended configuration
Grant accounts	Read
Grant administrators	Read
Grant read information	Enabled
Grant applications	Enabled
Grant read log	Enabled
Grant resource	Read

4. Verify Liongard Parent Inspector credentials

After validating Duo-side permissions, review the Parent Inspector configuration in Liongard.

Liongard field	Required value
API Hostname	Duo Admin API Hostname
Admin Integration Key	Admin API Integration Key
Admin Secret Key	Admin API Secret Key

5. Rerun with Clear Cache and Debug Mode

After changing permissions or credentials, perform a fresh inspection from the Duo Parent Inspector.

Clear Cache helps prevent stale data from masking configuration changes. Debug Mode provides additional execution detail that can help isolate whether the failure occurs during authentication, authorization, subaccount enumeration, or child system processing.

6. Confirm child discovery

After the Parent Inspector completes, navigate to Inspectors → Duo Security → Discovered Systems and confirm whether the expected child organizations appear.

If child accounts are present, map each discovered system to the appropriate Liongard Environment and activate the required child inspectors.
If child accounts are still missing, continue with the validation checklist below or escalate to Support.

Validation Checklist

Duo configuration

The Duo account is an MSP Parent account.
Expected subaccounts exist under the Parent account.
The Admin Integration Key is correct.
The Admin Secret Key is correct.
The API Hostname matches the Admin API application.
Required Parent permissions are enabled.
Sub-account permissions → Grant accounts → Read is enabled.
Required sub-account read permissions are enabled.
Unnecessary write permissions have not been granted unless explicitly needed.

Liongard configuration

Actual Admin credentials are entered in the Admin API fields.
The API Hostname matches the Admin API application.
The inspector was rerun using Clear Cache.
The inspector was rerun using Debug Mode.
The Inspector Timeline was reviewed for errors.

Duo Accounts API change summary

Duo has deprecated the legacy Accounts API and no longer allows new Accounts API integrations to be created. Existing Accounts API integrations were converted by Duo to Admin API integrations. For MSP use cases, sub-account access is provided through the Admin API with the appropriate sub-account permissions.

Liongard has updated the Duo Parent Inspector to handle this change. New and existing Parent Inspector configurations should use valid Admin API credentials; Accounts API credentials and placeholder values are no longer required.

Contact Support

If child accounts are still not discovered after completing the steps above, collect the following before:

Inspector name and Environment name
Description of the observed behavior
Inspector error details (if any)
Confirmation that the Duo tenant is an MSP Parent account
Confirmation that expected subaccounts exist
Screenshot of Parent Admin API permissions
Screenshot of Sub-account permissions
Results from the Clear Cache and Debug Mode run