The drama with Duo continues for me. Two different customer environments, same result: We try to configure using Duo's instructions https://duo.com/docs/sso-netscaler and everything seems fine but the moment you logon it kicks you over to EntraID instead, you logon and do the Universal Prompt from there... and then you get something like this image. Anyone else encountered this?

Make sure your NetScaler Management network that the NSIP lives in has a SNIP that has access to the internet. As the NetScaler has to validate the Oauth from duo. This has fixed the majority of people having issues similar to this.

Interesting, I will validate that but I would hope so!

We also have found using a login schema to put the username and password variables to alternate locations, like 15 and 16 work best. I have seen issues with certain users getting denied login, so something in their duo config is overriding the position 1 and 2 parameters.

We figured this out - by the by. The "email" in AD schema needs to match a valid domain and account that Duo has configured and as I mentioned, the bridge attributes need to be set correctly.