...
Grouper has a change log consumer which can sync a folder in grouper and use the extensions of groups in the folder as group names in Duo. It will also sync the group description to Duo. There is a daemon which will run periodically for a full refresh (nightly?). The change log consumer will sync changed changes real time.
Why use this?
You can have groups in Duo which are required for integrations. This is another layer of authorization and deprovisioning for your systems. For instance, you could have a group for your IT department, and require that group for your IT dept VPN, RDP, SSH. Someone not in that group would not be able to use those resources at the Duo level.
...