As a MSP, does my team need to setup authentication for admin rights for each client?

We are a MSP that’s new to DUO. So far we have one admin setup at each client which makes it kinda difficult when logging in. I know I can enroll the other techs one by one but is there a way to do it for each site at once? Or do I have to go in to each site and enroll a new user every time?


We are in the same boat. I have heard of some strategies where you end up protecting multiple clients in a single dedicated sub-tenant, however that defeats the purpose of multi tenancy in my opinion.

If each tech has a Duo admin account, then they can enroll their device on each client on an as needed basis. It does mean that there is a separate enrollment for each client on each device.
The tricky part is removing a device from each tenant when a tech leaves or is let go.

Interesting. So for billing purposes, if I have 10 techs added on each site, do we get billed additionally for that?

Billing is done per user not per device, so if you have 10x devices associated to 1x client admin, it only counts as 1x license.

Hi @DGbrandon and @ITEM93, thanks for posting!

Just want to make sure we’re covering your question/s correctly. Any admins added at the parent account level will have access to all sub-accounts you create for your customers. If you need your internal admins to access Duo-protected applications in a customer’s environment, you will need to set those admins up as users within the customer sub-account.

If you reach out to, we can get you in touch with your partner manager to help with your set-up and to discuss the billing piece of it as well.