When customers need help with the management of their WatchGuard Cloud account, Service Providers can request account delegation. When a customer delegates their Subscriber or Service Provider account to a Service Provider, the Service Provider manages the account, products and services on behalf of the customer. If a tier-1 Subscriber account delegates their account, the Service Provider can also manage their trials and inventory.
Service Providers can only manage a delegated account in the same cloud region as their Service Provider account.
For information on how to manage a delegated account or delegate an account, go to the appropriate topic:
- Manage a Delegated Account (Service Providers)
- Delegate Your Account (Subscribers)
Account delegation continues until the customer or Service Provider revokes the delegation.
You cannot revoke account delegation if there are devices in the account that subscribe to a Firebox template inherited from your account.
Your operator role determines what you can see and do in WatchGuard Cloud. Your role must have the Manage Tenants permission to view or configure this feature. For more information, go to Manage WatchGuard Cloud Operators and Roles.
Manage Inventory in Delegated Tier-1 Subscriber Accounts
To support partner business models, tier-1 Service Providers can allocate trials and commercial licenses for WatchGuard products and services to delegated tier-1 Subscriber accounts (for example, Fireboxes, access points, AuthPoint users, and endpoint products and modules). Service Providers can allocate inventory to tier-1 Subscriber accounts as a term or subscription allocation type. This includes term licenses purchased with MSSP Prepaid Points.
Service Providers cannot reallocate inventory from one managed account to a delegated tier-1 Subscriber account. They can only allocate inventory from their tier-1 Service Provider account to the delegated tier-1 Subscriber account.
For example, Service Providers can use delegated inventory to address these inventory challenges:
- FlexPay Subscriptions — Use FlexPay subscriptions to deploy licenses to any account they manage, including delegated tier-1 Subscriber accounts.
- On-boarding — Quickly and easily on-board new customers, even if the customer already has their own WatchGuard Cloud account. You cannot copy the configuration between cloud-managed devices when the device is in the inventory of a delegated tier-1 Subscriber account.
- Module Licensing — Add Endpoint Security module licenses to customer accounts, even if the customer owns the original base product (for example, WatchGuard EPDR and Patch Management).
Service Providers can allocate more of an existing product as well as new products to the inventory that the delegated tier-1 Subscriber already has.
Inventory must be de-allocated from the tier-1 Subscriber account before you can remove access. For information on how to remove delegated access, go to Remove Access.
Inventory Allocation Page for Tier-1 Subscriber Accounts
Delegated tier-1 Subscriber accounts can also allocate inventory to their own accounts. On the Inventory > Allocation page, Service Providers can see the inventory that a delegated account allocated to their own account, but they cannot edit the inventory allocation.
In this table, you can see two allocations of the same product to the tier-1 Subscriber account. The first allocation is from the Service Provider account. To edit the allocation, the Service Provider can click the account name. The second allocation was made by the tier-1 Subscriber account and the Service Provider cannot edit it.
