You can utilize the DUO AD Proxy. It essentially pretends to be your AD server from CPPM's eyes. The below graphic is for RADIUS auth against a switch, but the same principle applies.
Authentication Proxy Reference - Duo | Duo Security
------------------------------
ACEX #137
------------------------------
Original Message:
Sent: Jun 11, 2025 02:00 PM
From: Jscott1
Subject: LDAP + Duo MFA for Admins, Aruba Clearpass 6.11
Hello, we are starting to roll out with this in a live environment, I have configured LDAP within clearpass and it functions as it's supposed to. My manager is requesting we put Duo MFA on top of that login to require us to authenticate before access. We already have Duo used to authenticate to a few things, I am not sure how to require Clearpass to authenticate admins logging in with ldap with duo.