DUO MFA popup twice for approval login GloablProtect

[boblin]

We configured PA 850 firewall to use DUO for GloablProtect MFA. It works. However, we have an issue. In GloablProtect Gateway Configuration>Agent>Client Settings, if I add a user, for example blin. it works fine. If I add a AD OU, for example Employees, the login user will get two DUO aoorval popup twice. 

From the DUO Authentication, I can see two Granted. 

Why it works if I add a user manually one by one, but it popup for two MFA approvals if I add the group or UO to the Gateways?

[BPry · Accepted solution]

@boblin,

Do you have DUO configured on both the Portal and the Gateway, or just the gateway? If you have it on both, are you using authentication cookies at all to avoid the double prompt? 

[boblin]

I have just one DUO authentication for both. Where to configure authentication cookies?

[boblin]

I have both Generate cookie for authentication override and Accept cookie for authentication override checked. Is this you talking about?

[boblin]

This is how I fix the problem step by step with screenshots:

• DUO MFA popup twice for approval login GloablProtect