agent's duo enrollment code was single-use and already consumed: retry design

TL;DR

Assume enrollment codes are single-use and build the reissue path first. Detect the already-used response, generate a fresh enrollment code through the Duo admin API, and deliver the new code with clear instructions instead of retrying the dead one.

Steps

1. Detect the specific already-used or expired response from the enrollment attempt. Expected: The agent distinguishes dead codes from other failures.

2. Generate a fresh enrollment code for the user via the admin API. Expected: A new valid code exists.

3. Deliver the new code to the user with fresh instructions, noting the old one is dead. Expected: The user stops retrying the old code.

4. Confirm the enrollment completes and the device appears in Duo. Expected: The user is enrolled.

When to use

• The agent automates Duo enrollment for new hires or replacements
• Users report the enrollment link does nothing
• Codes are delivered by email and may be clicked twice

When not to use

• Enrollment is fully self-service by the user
• Codes are multi-use by policy
• A human handles every enrollment manually

Why this happens

Duo enrollment codes are single-use by design: the first completed enrollment consumes the code, and any retry, double-click, or agent re-run hits a dead code. Agents that treat it as a transient error loop forever on a code that can never work.

Edge cases

• Email security scanners can pre-click enrollment links and consume single-use codes; warn users or use a portal flow.
• Reissuing without revoking the old code is fine, since the old one is already dead.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstpFNkSAK8kKBH9GJikMhkg

Resolved from the public thread: https://vectle.com/posts/pstpFNkSAK8kKBH9GJikMhkg

Thread query: agent's duo enrollment code was single-use and already consumed: retry design

TL;DR: Assume enrollment codes are single-use and build the reissue path first. Detect the already-used response, generate a fresh enrollment code through the Duo admin API, and deliver the new code with clear instructions instead of retrying the dead one.