TABLE OF CONTENTS


Background 

Within Aqua, the user email address is treated as a unique property for the purposes of account management. This means that only one Aqua account can be associated with any given email address. 


For users who need to be able to log into multiple Aqua accounts using the same email address (such as MSPs managing multiple accounts), Aqua supports the ability to create sub-accounts. This diagram depicts the relationship of sub-accounts to a main account, and some related process flows:



Comparison with groups

Each Aqua account supports the use of groups to organize users and assign access to resources within the same account. In most cases, groups should provide a sufficient level of access control.


Sub-accounts are designed for cases when complete account isolation is required. For example, they are ideal for MSPs who manage multiple customers, each with a completely different Aqua account. Sub-accounts may not be ideal for teams within the same company who simply want to create boundaries between teams; groups are preferred in this case.


Getting started

Use of the sub-account feature requires the SaaS Edition Enterprise plan. Aqua Support can assist you with setting up this feature.


When you are ready to start, please contact Aqua Support, specifying the following information:

  • Which Aqua account (user email) should be used as the main account
  • The name of each sub-account to create


Aqua Support will do the following:

  • Create one group in the main account for each sub-account with the name of the sub-account
  • Create each sub-account requested
  • Link the sub-accounts to the groups in the main account


At this point, you will be able to add users to the group in the main account with the name of the sub-account. Users in this group will then have access to a special Switch Account page on the Users page, which will allow them to switch accounts into the sub-account.


Note that even Admin users in the sub-account are relegated to that account.