As a MSP, does my team need to setup authentication for admin rights for each client?

[DGbrandon]

We are a MSP that’s new to DUO. So far we have one admin setup at each client which makes it kinda difficult when logging in. I know I can enroll the other techs one by one but is there a way to do it for each site at once? Or do I have to go in to each site and enroll a new user every time?

Thanks

[ITEM93]

We are in the same boat. I have heard of some strategies where you end up protecting multiple clients in a single dedicated sub-tenant, however that defeats the purpose of multi tenancy in my opinion.

If each tech has a Duo admin account, then they can enroll their device on each client on an as needed basis. It does mean that there is a separate enrollment for each client on each device.
The tricky part is removing a device from each tenant when a tech leaves or is let go.

[DGbrandon]

Interesting. So for billing purposes, if I have 10 techs added on each site, do we get billed additionally for that?

[ITEM93]

Billing is done per user not per device, so if you have 10x devices associated to 1x client admin, it only counts as 1x license.

[ekduo · Accepted solution]

Hi @DGbrandon and @ITEM93, thanks for posting!

Just want to make sure we’re covering your question/s correctly. Any admins added at the parent account level will have access to all sub-accounts you create for your customers. If you need your internal admins to access Duo-protected applications in a customer’s environment, you will need to set those admins up as users within the customer sub-account.

If you reach out to msp@duo.com, we can get you in touch with your partner manager to help with your set-up and to discuss the billing piece of it as well.