Skip navigation

MSP Access Tags

Last updated:

The "Access Tags" page is a Beta feature.

Overview

Access tags allow you to granularly control administrative access to subaccounts. With access tags, you can allow administrators without the Owner role to receive access to specific Duo Managed Service Providers (MSP) subaccounts and deny access to others without having to manage multiple logins.

For example, all administrators with the tag “Government Restricted” can access any subaccounts associated with that tag, but administrators without the tag cannot access these subaccounts.

Administrators can access accounts that they share at least one access tag with. You can also create access tags while creating or editing a subaccount. Access tags can also be applied while editing an individual subaccount or administrator.

View the Access Tags Page

Role required: Owner

To view the "Access Tags" page:

  1. Log into the Duo Admin Panel.

  2. Navigate to the Accounts → Access Tags page in the Duo Admin Panel.

    Access Tags Page

  3. If you have access tags already, you will find a list of your access tags, description and how many administrators and subaccounts the tag is applied to.

    List of Access Tags

Add Access Tags

To add access tags:

  1. From the "Access Tags" page, click the +Add Access Tag button in the top right of the Access Tags table. The +Add Access Tag button is also shown in the center of the table when there are no tags listed in the table and the table is empty.

  2. Enter a name for the Access tag. Enter a description of the access tag (optional).

    Add Access Tags

  3. Click Add access tag.

Apply Access Tags to Admins and Subaccounts

Since this access tag is new, a “Grant Proper Access” banner appears. You can now apply the tag to admins and subaccounts.

  1. Scroll to the “Administrators with this access tag” table, click Apply tag to admins.

    Apply Access Tags to Admins

  2. From the "Administrators" page, use the checkbox to select the administrators that you would like to have this access tag. They will be able to access any subaccounts with this access tag. Then click Apply access tag.

    Apply Access Tags to Admins
    • Owners can access all subaccounts and cannot be selected. Admins who have already had this access tag applied to them cannot be selected.

  3. Scroll to the “Subaccounts with this access tag” table and then click on Apply tag to Subaccounts.

  4. From the "Subaccounts" page, use the checkbox to select the subaccounts that you would like to have this access tag. These subaccounts can be accessed by any admin that shares this tag. Click on Apply access tag.

    • Subaccounts with no tags can be accessed by any admin.
    • Already selected subaccounts cannot be selected.
    Apply Access Tags to Admins

  5. Click the Access tag summary button in the upper right side of the "Access Tags" page to download a .csv file to help you validate your access tags. (Optional)

    • Owner admins have access to all subaccounts and will have ‘(owner)’ appended to their name in the column with the admin names.

Apply Access Tags When Creating a Subaccount

To apply access tags when creating a subaccount:

  1. Navigate to the "Accounts" page in the Duo Admin Panel.

  2. From the "Accounts" page, click to +Add account.

  3. From the "Add Account" page, click Add access tag.

    Add Access Tags to Account

  4. From the "Add Access Tag" page, enter your chosen access tag in the Access Tag Name field. Note: Access tags are case-sensitive. Please be mindful of capitalization when creating new access tags.

  5. Click Add access tag.

Add Access Tags to Account

The access tag is now automatically added to the Access tags field in the Account Details section. The new access tag is also added to the drop-down list of all access tags that can be assigned to subaccounts and administrators.

Add Access Tags to Existing Subaccounts

To add access tags to existing subaccounts:

  1. Navigate to the "Accounts" page in the Duo Admin Panel.

  2. For the subaccount you want to add access tags, use the pull-down list on the right of the subaccount name and click Edit.

    Add Access Tags to Subaccount

  3. From the subaccount page, in the Details section, use the pull-down list under "Access Tags" to select an existing access tag to add.

  4. To create and add a new access tag, click Add access tag. Follow the instructions in Add Access Tags to create and add a new access tag.

  5. Click Save.

Apply Access Tags to Administrators

Non-Owner administrators will need to have access tags assigned to them that correlate to which subaccounts they’ll have access. An administrator can access a subaccount if:

  • The administrator has an Owner role at the account level.
  • The subaccount does not have any access tags.
  • The administrator shares at least one tag in common with the subaccount.

To apply access tags to Administrators:

  1. Navigate to the Users → Administrators page and select an Administrator.

  2. Scroll down to the Subaccount role section, and under Access tags, search and view through the drop-down list of existing tags. Once an access tag is chosen from the search list, it will appear in the input field.

    List Access Tags from subaccounts

Note: New access tags cannot be created from the Administrators detail page. Follow the instructions in Add Access Tags to create and add a new access tag.

Account Switcher and Access Tags

The account switcher at the top of the Duo Admin Panel is the preferred way to switch to a subaccount. Administrators will only be able to see the subaccounts they have access to. If an administrator cannot find an account they need access to, they should contact an account owner for help accessing it.

Frequently Asked Questions

Who can edit access tags?

  • Administrators with the Owner role at the top account level or main account level.

How do access tags apply to Owner administrators?

  • Owner administrators at the top account level have access to all subaccounts.

When can an administrator access a subaccount?

  • An administrator can access a subaccount if:
    • The administrator has an Owner role at the top account level.
    • The subaccount does not have any access tags assigned to it.
    • The administrator shares at least one tag in common with the subaccount.

Are access tags a one-to-one assignment?

  • No. A single subaccount, or a single administrator, can have multiple tags assigned depending on how the organization would like to segment access. An administrator can access a subaccount if they share any tag in common with the subaccount.

Are access tags case-sensitive?

  • Yes. Please be mindful of capitalization in tags.

Is there a way to manage access tags in bulk?

  • Yes, you can use the "Access Tags" page to manage access tags in bulk.

Is there an API that I can use to assign access tags?

  • There are currently no available endpoints to manage access tags using Duo’s APIs.

Where can I see all of my access tags?

Any tag that is assigned to an administrator or a subaccount can be seen from the drop-down list of access tags on the "Add Account", "Edit Account", "Add Administrator", or individual "Administrator" pages. You can also see all of your access tags on the "Access Tags" page overview.

How can I delete an access tag?

Navigate to the "Access Tags" page, select the access tag you want to delete, and then click Delete access tag in the upper right side of the Details page. Click Delete access tag again to confirm.

Where can I see a summary of which administrators have access to which subaccounts?

You can download an administrator access summary from the "Administrators" page in your Duo Admin Panel. You can also download an overview of which access tags give Admins access to certain subaccounts by clicking the Access tag summary button in the upper right side of the "Access Tags" page.

Troubleshooting

Need some help? Take a look at our MSP Knowledge Base articles or Community discussions. For further assistance, contact Support.