diff --git a/authentik/stages/authenticator_duo/migrations/0002_default_setup_flow.py b/authentik/stages/authenticator_duo/migrations/0002_default_setup_flow.py
new file mode 100644
index 000000000..858b65be8
--- /dev/null
+++ b/authentik/stages/authenticator_duo/migrations/0002_default_setup_flow.py
@@ -0,0 +1,55 @@
+# Generated by Django 3.1.1 on 2020-09-25 14:32
+
+from django.apps.registry import Apps
+from django.db import migrations
+from django.db.backends.base.schema import BaseDatabaseSchemaEditor
+
+from authentik.flows.models import FlowDesignation
+
+
+def create_default_setup_flow(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+    Flow = apps.get_model("authentik_flows", "Flow")
+    FlowStageBinding = apps.get_model("authentik_flows", "FlowStageBinding")
+
+    AuthenticatorDuoStage = apps.get_model(
+        "authentik_stages_authenticator_duo", "AuthenticatorDuoStage"
+    )
+
+    db_alias = schema_editor.connection.alias
+
+    flow, _ = Flow.objects.using(db_alias).update_or_create(
+        slug="default-authenticator-duo-setup",
+        designation=FlowDesignation.STAGE_CONFIGURATION,
+        defaults={
+            "name": "default-authenticator-duo-setup",
+            "title": "Setup Duo",
+        },
+    )
+
+    stage, _ = AuthenticatorDuoStage.objects.using(db_alias).update_or_create(
+        name="default-authenticator-duo-setup"
+    )
+
+    FlowStageBinding.objects.using(db_alias).update_or_create(
+        target=flow, stage=stage, defaults={"order": 0}
+    )
+
+    for stage in AuthenticatorDuoStage.objects.using(db_alias).filter(
+        configure_flow=None
+    ):
+        stage.configure_flow = flow
+        stage.save()
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        (
+            "authentik_stages_authenticator_duo",
+            "0001_initial",
+        ),
+    ]
+
+    operations = [
+        migrations.RunPython(create_default_setup_flow),
+    ]