Duo (https://duo.com/) integrates with your Cisco ISE to add two-factor authentication.
This Cisco ISE integration support push, phone call, or passcode authentication. This configuration does not feature the interactive Duo Prompt for web-based logins, but does capture client IP information for use with Duo policies (https://duo.com/docs/policy), such as geolocation and authorized networks.
Read the Duo documentation for this integration at https://duo.com/docs/ciscoise-radius.