Child Account Permissions

[tgeo-duo]

We have clients listed as Child Accounts. I would like to assign certain users access to certain Child Accounts but not others. I called support and this does not seem possible at this time. Besides creating email aliases/logins for each child account has anyone found a way around this?

[jyoung1]

Hey @tgeo-duo,
Can you please help with one point of clarification? Are you trying to add Duo Users to specific sub-accounts to use Duo to get access to applications that you’re managing on behalf of your customers? Or are you trying to add Duo Admins to specific sub-accounts but not others to administer Duo functions? Thank you.

[tgeo-duo]

@jyoung Excellent question. Ultimately I would like to grant users in the parent tenant administrative rights to the child accounts. That way they can administer clients but maintain least privilege on the parent account. Does that make sense?

[jyoung1]

@tgeo-duo,
It sort-of makes sense.

With Duo, admins are always free of charge and users are billable.

With the Duo MSP program, you can add Admins to the parent account and they will have the same role across all sub-accounts. I understand that ideally you’d be able to pick which sub-accounts each admin has access to and give them a specific role for that specific account. That’s a feature request that our product team is aware of.

If you need your employees to be added as Duo users across multiple accounts so that they can access applications that you’re managing, and therefore are paying for the same physical people multiple times as Duo users across multiple accounts, please email msp@duo.com to be connected with your partner manager to discuss the situation and see if a manual billing adjustment might be the correct course of action to make sure you’re not paying for duplicate users.

So, what you’re asking for doesn’t quite exist today. On the admin side, we are aware of the need and hope it will be added in the future. On the user side, we can adjust billing for duplicate users and are also working on industry integrations that may reduce or erase some of these issues entirely.

Thank you for the question!