No SAML request provided from outside firewall

New at this. We are setting up DUO for use with Office365 which is connected to our local on-premise AD domain. We have a local cert authority. We have authentication working internally for a test user. Outside our firewall we get the below. Any thoughts?
"
Duo Access Gateway

Duo

No SAML request provided

You accessed the Single Sign On Service interface, but did not provide a SAML Authentication Request. Please note that this endpoint is not intended to be accessed directly."

How did you arrive at the Duo Access Gateway page? Were you redirected there from the Office 365 login portal, or did you try to access it directly (like you were trying to get to the DAG Launcher page to log in and click the Office 365 application tile)?

You may find it easier to contact Duo Support for troubleshooting assistance. This community forum isn’t intended as a replacement for technical support.