Would AD sync create new accounts for aliases?

[hashbrownnnnnn]

This is probably not best practice, but I have a few AD accounts that share a DUO account as aliases.

AD Account:
Username1
Username2

DUO account:
Username1 (Username2 is an alias)

Would performing directory sync create a new DUO account for Username2?

[raphka · Accepted solution]

Hi hashbrownnnnnn, Welcome to the Duo Community!

In short, no Username2 would not be synced to Duo at all.

In Duo all users and aliases must be unique, they cannot be shared between users so that we know which user object to contact for 2fa during an authentication.

If you have created a user in Duo as:
“DUO account:
Username1 (Username2 is an alias)”

When you run the sync for:
“AD Account:
Username1
Username2”

The Username2 user would be skipped by the sync entirely as the Username2 user cannot be created in Duo as this already exists as the alias of another user.
The AD sync would log this in the sync event details that can be found in the Administrator Actions log.
Please see the article below for further details on reviewing the Duo Administrator Actions Log:
https://help.duo.com/s/article/4180