We are setup with two enrollment methods. Inline SelfEnroll is the primary for citrix users, so they enroll themselves the first time they login. We also have a couple hundred who were ad-sync enrolled through a security group, SG_Duo I was wondering...

Is it possible to roll out protection for all endpoints but only prompt for Duo when users login with an admin account? (domain admin, IT support desk, etc…)?