MSP Access Tags

The "Access Tags" page is a Beta feature.

Overview

Access tags allow administrators without the Owner role to receive access to specific Duo Managed Service Providers (MSP) subaccounts and deny access to others without having to manage multiple logins.

For example, all administrators with the tag “Government Restricted” can access any subaccounts associated with that tag, but administrators without the tag cannot access these subaccounts.

Administrators can access accounts that they share at least one access tag with. You can also create access tags while creating or editing a subaccount. Access tags can also be applied while editing an individual subaccount or administrator.

View the Access Tags Page

Role required: Owner

To view the "Access Tags" page:

1. Log into the Duo Admin Panel.

2. Navigate to the Accounts → Access Tags page in the Duo Admin Panel.

   

3. If you have access tags already, you will find a list of your access tags, description and how many administrators and subaccounts the tag is applied to.

   

Add Access Tags

To add access tags:

1. From the "Access Tags" page, click the +Add Access Tag button in the top right of the Access Tags table. It is also shown in the center of the table.

2. Enter a name for the Access tag. Enter a description of the access tag (optional).

   

3. Click Add access tag.

Apply Access Tags to Admins and Subaccounts

Since this access tag is new, a “Grant Proper Access” banner appears. You can now apply the tag to admins and subaccounts.

1. Scroll to the “Administrators with this access tag” table, click Apply tag to admins.

   

2. From the "Administrators" page, use the checkbox to select the administrators that you would like to have this access tag. They will be able to access any subaccounts with this access tag. Then click Apply access tag.

   
   • Owners can access all subaccounts and cannot be selected. Already selected admins who have already been assigned a different access tag can't be selected.

3. Scroll to the “Subaccounts with this access tag” table and then click on Apply tag to Subaccounts.

4. From the "Subaccounts" page, use the checkbox to select the subaccounts that you would like to have this access tag. These subaccounts can be accessed by any admin that shares this tag. Click on Apply access tag.

   • Subaccounts with no tags can be accessed by any admin.
   • Already selected subaccounts cannot be selected.
   

5. Click the Access tag summary button in the upper right side of the "Access Tags" page to download a .csv file to help you validate your access tags. (Optional)

   • Owner admins have access to all subaccounts and will have ‘(owner)’ appended to their name in the column with the admin names.

Create Subaccounts with Access Tags

To create subaccounts with access tags:

1. Navigate to the "Accounts" page in the Duo Admin Panel.

2. From the "Accounts" page, click to +Add account.

3. From the "Add Account" page, click Add access tag.

   

4. From the "Add Access Tag" page, enter your chosen access tag in the Access Tag Name field. Note: Access tags are case-sensitive. Please be mindful of capitalization when creating new access tags.

5. Click Add access tag.

The access tag is now automatically added to the Access tags field in the Account Details section. The new access tag is also added to the drop-down list of all access tags that can be assigned to subaccounts and administrators.

Add Access Tags to Administrators

Non-Owner administrators will need to have access tags assigned to them that correlate to which subaccounts they’ll have access. An administrator can access a subaccount if:

• The administrator has an Owner role at the account level.
• The subaccount does not have any access tags.
• The administrator shares at least one tag in common with the subaccount.

To add access tags to Administrators:

1. Navigate to the Users → Administrators page and select an Administrator.

2. Scroll down to the Subaccount role section, and under Access tags, search and view through the drop-down list of existing tags.

   

3. Navigate to Accounts → Access Tags page to add new tags. Once an access tag is chosen from the search list, it will show in the input field.

Account Switcher and Access Tags

The account switcher at the top of the Duo Admin Panel is the preferred way to switch to a subaccount. Administrators will only be able to see the subaccounts they have access to. If an administrator cannot find an account they need access to, they should contact an account owner for help accessing it.

Frequently Asked Questions

Who can edit access tags?

• Administrators with the Owner role at the top account level or main account level.

How do access tags apply to Owner administrators?

• Owner administrators at the top account level have access to all subaccounts.

When can an administrator access a subaccount?

• An administrator can access a subaccount if:
  • The administrator has an Owner role at the top account level.
  • The subaccount does not have any access tags assigned to it.
  • The administrator shares at least one tag in common with the subaccount.

Are access tags a one-to-one assignment?

• No. A single subaccount, or a single administrator, can have multiple tags assigned depending on how the organization would like to segment access. An administrator can access a subaccount if they share any tag in common with the subaccount.

Are access tags case-sensitive?

• Yes. Please be mindful of capitalization in tags.

Is there a way to manage access tags in bulk?

• Yes, you can use the "Access Tags" page to manage access tags in bulk.

Is there an API that I can use to assign access tags?

• There are currently no available endpoints to manage access tags using Duo’s APIs.

Where can I see all of my access tags?

Any tag that is assigned to an administrator or a subaccount can be seen from the dropdown list of access tags on the "Add Account", "Edit Account", "Add Administrator", or individual "Administrator" pages.

How can I delete an access tag?

If a tag is no longer assigned (to any administrator or any subaccount), it will no longer appear as an option in the dropdown list of access tags on the "Add Account", "Edit Account", "Add Administrator", or individual "Administrator" pages.

Why can an administrator see subaccounts they do not share tags with on the Accounts page and Account Switcher?

This is by design. They will receive an error message and will not be able to switch into the subaccount unless they share a tag.

Where can I see a summary of which administrators have access to which subaccounts?

You can download an administrator access summary from the "Administrators" page in your Duo Admin Panel.

Troubleshooting

Need some help? Take a look at our MSP Knowledge Base articles or Community discussions. For further assistance, contact Support.