Get Started in WatchGuard Cloud

WatchGuard Cloud is a cloud-based security platform that enables you to monitor and manage your WatchGuard products in one place. This topic provides new users with an overview of the cloud platform and introduces platform features. For partners that want to migrate locally-managed Fireboxes to cloud management, it also provides the basic steps to set up accounts in WatchGuard Cloud to manage the migrated Fireboxes.

Before You Begin

Before you begin, make sure you have a basic understanding of accounts, operators, and roles in WatchGuard Cloud. You can review this information here.

Get Started

To get started with WatchGuard Cloud, complete these steps:

• Step 1: Log In to WatchGuard Cloud.
• Step 2: Explore the WatchGuard Cloud User Interface.
• Step 3: Add Managed Accounts and Operators.

To monitor or manage devices from WatchGuard Cloud, you add the Firebox or access point to your WatchGuard Cloud account. For more information, go to Get Started — Add a Device to WatchGuard Cloud.

Step 1: Log In to WatchGuard Cloud

Log in to WatchGuard Cloud to start a new session and log out when you want to end the session. Your login credentials tell WatchGuard Cloud who you are and what permissions you have. In a tier-1 WatchGuard Cloud account, operators use the same user account credentials to log in to WatchGuard Cloud as they use to log in to the WatchGuard website (www.watchguard.com).

If you are new to WatchGuard and want to activate a product for use in WatchGuard Cloud, you must first create a WatchGuard account. You can create an account from the WatchGuard login page. (external link)

To log in to WatchGuard Cloud:

1. Go to cloud.watchguard.com.
2. Enter your WatchGuard User Name and Password.
   
3. Click Log In.

For increased security, operator accounts might have multi-factor authentication (MFA) enabled. If your administrator enabled MFA for your account, you must also authenticate with a token in the AuthPoint mobile app.

For more information on MFA, go to Enable MFA for WatchGuard Cloud Operators.

For users and endpoints to connect to WatchGuard Cloud, your network must allow connections to the URLs and IP ranges used by WatchGuard Cloud products and services. For more information, go to WatchGuard Cloud URLs and Network Access Requirements.

Step 2: Explore the WatchGuard Cloud User Interface

With WatchGuard Cloud, you can see and manage your products and services in one place. Different areas of the WatchGuard Cloud user interface provide information on your products and services.

WatchGuard Cloud supports the most recent version of these web browsers: Google Chrome, Microsoft Edge, Mozilla Firefox, and Safari.

From the left pane of the user interface, Service Provider operators use Account Manager to navigate their managed accounts and devices. Subscriber operators use Device Manager to see and manage their devices.

Dashboards

From the top menu, when you select Dashboard, the Dashboard page shows content specific to the account, folder, or device selected in the left pane.

There are different dashboards for Service Providers and Subscribers:

Service Provider Dashboards

For Service Provider accounts, the Dashboard page shows a quick overview of your Service Provider account and your managed Service Provider and Subscriber accounts.

On the Dashboard page, several widgets show important information and provide useful links when you select Overview, My Account, another Service Provider account, or a Subscriber account in Account Manager. For example:

• Allocation Usage and License Details — Allocation widgets show the number of allocated and unallocated users or endpoints. This can help you see if your account has sufficient licenses.
• Device Status — This widget shows the status of Firebox and Access Point connections to WatchGuard Cloud (Connected, Not Connected, Inactive, and Never Connected).
• Failed Authentications by Account — This widget shows a bar graph with the number of failed AuthPoint authentications in your accounts.

On the Overview dashboard and other Service Provider dashboards, you can select a date range, add widgets, remove widgets, and reorder the widgets. When you customize a dashboard, the changes are unique to that dashboard and unique to your operator account.

For more information, go to About the Service Provider Dashboard.

Subscriber Dashboard

For Subscriber accounts, the Dashboard page shows aggregated information to give you a quick overview of your account. Several widgets on the page display key metrics and important information. The dashboard is not customizable. Click the title of any widget to see more detailed information.

For more information, go to About the Dashboard for Subscriber Accounts.

Alerts

Alerts are notifications about your account or about specific events that occur in WatchGuard Cloud, products, or devices. For example, you can receive an alert for events such as when you successfully delegate your account or when a Firebox feature key will expire. Alerts make sure that you are aware of any significant changes that affect your account, licenses, products, or devices.

For more information, go to Manage WatchGuard Cloud Alerts.

In the top menu, if there are active alerts for your account, you see a red indicator next to the alerts icon () located in the top, right corner. This shows the number of active alerts.

Audit Logs

Audit logs provide a historical record of all logins and changes made in WatchGuard Cloud. WatchGuard Cloud generates audit logs for events that occur in WatchGuard Cloud. WatchGuard Cloud generates audit logs when operators log in or log out or change settings. To review audit logs, select Administration > Audit Logs.

For more information, go to See Audit Logs.

Monitor and Configure Products and Services

The Monitor and Configure menus provide direct access to your WatchGuard products. The options available in each menu depend on the account, folder, or device selected in the left pane.

From the Monitor menu, you can monitor ThreatSync, Fireboxes, access points, and products such as AuthPoint, Endpoint Security, and ThreatSync+. You can monitor the live status and activity of all connected devices (Fireboxes and access points).

From the Configure menu, you can manage and configure ThreatSync, devices, products such as AuthPoint, Endpoint Security, and ThreatSync+, and shared configurations such as access point sites, directories and domain services, Firebox templates, splash pages, and VPNs.

Inventory

Product or service licenses activated at www.watchguard.com show in your WatchGuard Cloud inventory.

From the Inventory menu, Service Providers can review inventory summaries, allocated and unallocated devices and products, as well as license information. They can allocate users and endpoints from available licenses and specify the license expiration date. The options available depend on the account, folder, or device selected in the left pane.

For more information, go to Inventory Management.

Account Administration

From the Administration menu, you can configure settings for your WatchGuard Cloud account, and see license information about the products you manage in WatchGuard Cloud.

You can also configure account-level features for:

• Managed access — On the Managed Access page, you manage external access to your WatchGuard Cloud account and services.
• Trials — On the Trials page, Service Providers can start free 30-day product trials for their account and accounts they manage.
• Beta features — On the Beta Features page, you can preview new functionality and applications.
• Custom branding — On the Custom Branding page, you can brand WatchGuard Cloud with your own logos and images to communicate with clients and users and make sure they know who to contact in the event of service issues.
• Dark Web Scan — On the Dark Web Scan page, you can search data breaches for email addresses and domains.
• API usage — On the API Usage page, you monitor WatchGuard public API usage statistics for your account.
• Certificates — On the Certificates page, you manage your account level certificates.
• Audit logs, notifications, and scheduled reports — On the Audit Logs, Notifications, and Scheduled Reports pages, you can monitor your account, products, and services. You can view announcements, and add and download scheduled reports.

For more information, go to WatchGuard Cloud Account Administration.

Scheduled Reports

WatchGuard Cloud includes scheduled and on-demand reports to help you monitor your WatchGuard products. From the Administration menu, select Scheduled Reports to run reports daily, weekly, monthly, or immediately and to send the generated reports to specified email recipients. You can also download scheduled reports from WatchGuard Cloud.

For more information on scheduled reports, go to Scheduled Reports.

Step 3: Add Managed Accounts and Operators

This section provides basic steps to set up accounts and operators in three scenarios:

• MSP with Subscribers Only
• MSP with Managed Service Providers
• MSP with Delegated Tier-1 Subscriber Account

For simplicity, the scenarios refer to Managed Service Providers (MSPs). MSP could include both WatchGuard partners and Managed Security Service Providers (MSSPs).

If you add an operator to a tier-1 Subscriber account, or a tier-n Service Provider or Subscriber account, the new operator can log in to WatchGuard Cloud (cloud.watchguard.com), but cannot log in to Support Center at www.watchguard.com.

MSP with Subscribers Only

In this scenario, an MSP has a number of customers they want to manage. To do this in WatchGuard Cloud, add each customer as a separate Subscriber account.

We recommend that you create a new Subscriber account for each new customer. This enables separate reporting for each customer account, as well as separate configurations for products like AuthPoint.

Complete these steps:

1. Add a Subscriber Account for Each Customer.

2. Add Operators to Your Account.

1. Add a Subscriber Account for Each Customer

Account Manager provides a unified view to manage your Subscriber accounts. To manage customers in WatchGuard Cloud, consider these best practices:

• Add a Subscriber account below your account for each customer you manage.
• Do not create folders for each customer below My Account to organize devices and customers.
• Use My Account and the folders below it to manage your own devices and perform internal tests.

To add a managed Subscriber account, from Account Manager:

1. In the upper, right corner of Account Manager, click .
   

2. In the Account Name text box, type the name of the customer account.
3. In the Account Type section, select Subscriber.
4. In the Contact section, add the contact information for the customer contact.
   In the Email text box, enter an email address that WatchGuard or you could use to contact the person responsible for the account.
5. (Optional) Add the Mailing Address and Billing Address.
6. Click Save.
7. Repeat these steps for each customer account.

2. Add Operators to Your Account

Operators are users who can log in to WatchGuard Cloud to view and manage account information, configure products, and see reports. Each account could have operators with different permissions and access. For managed accounts, you do not have to add operators if you intend to configure and manage the account and services on behalf of your customer.

Add operators to your account, and if required, add operators to your customer accounts so that they can create and manage their own account.

Your operator role determines what you can see and do in WatchGuard Cloud. Your role must have the Manage Tenants permission to add operators to a managed account. For more information, go to Manage WatchGuard Cloud Operators and Roles.

To add an operator to an account:

1. From Account Manager, select the account you want to add an operator to.
   To add operators to your account, select Overview or My Account. If you select My Account, you will add operators to your Subscriber account.
2. Select Administration > Operators and Roles.
3. On the Operators page, click Add Operator.



4. In the User Name text box, type a user name.
5. In the Email text box, type the email address of the operator.
6. In the First Name and Last Name text boxes, type the first and last name of the operator.
7. To assign permissions to the operator, from the Select Role drop-down list, select an operator role. For information on custom operator roles, go to Manage Custom Operator Roles.
8. To require the operator to authenticate with the AuthPoint app, enable the Multi-Factor Authentication toggle. For more information, go to Enable MFA for WatchGuard Cloud Operators.
   The Confirm Email Address dialog box opens.
9. Click Confirm Email.
10. Click Save.
    WatchGuard Cloud sends an email message to the new operator with a link to set a password.
11. Repeat these steps for each operator you want to add.

MSP with Managed Service Providers

In this scenario, an MSP manages Service Providers who manage other Service Provider or Subscriber accounts. WatchGuard Cloud is a multi-tenant, multi-tier system. Both the MSP and their managed Service Provider accounts can manage other Service Provider and Subscriber accounts. The hierarchy in Account Manager can include up to five tiers of accounts (for example, tier-1 Service Provider > tier-2 Service Provider > tier-3 Service Provider > tier-4 Service Provider > tier-5 Subscriber).

Complete these steps:

1. Add a Managed Service Provider Account.

2. Add a Subscriber Account to the Managed Service Provider Account.

3. Add Operators to the Managed Service Provider Account.

1. Add a Managed Service Provider Account

MSPs can manage inventory and allocate devices, licenses, and users or endpoints to managed Subscriber and Service Provider accounts. You can manage products in your own account and for all accounts you manage. In this scenario, you add a Service Provider account to manage their own Subscriber accounts.

As an MSP, you can allocate inventory (devices, users, or endpoints) to any Service Provider or Subscriber account you manage. When you manage another Service Provider, make sure there is agreement on who can allocate inventory to the managed Subscriber accounts. For example, maybe as the MSP or tier-1 Service Provider, you will only allocate inventory to the tier-2 Service Provider. The tier-2 Service Provider is then responsible for the allocation of inventory to their managed accounts.

To add a managed Service Provider account, from Account Manager:

1. In the upper, right corner of Account Manager, click .
   

2. In the Account Name text box, type the customer name for the Service Provider account.
3. In the Account Type section, select Service Provider.
4. In the Contact section, add the contact information for the account owner.
   In the Email text box, enter an email address that WatchGuard or you could use to contact the person responsible for the account.
5. (Optional) Add the Mailing Address and Billing Address, if required.
6. Click Save.
7. Repeat these steps for each Service Provider account you want to add.
   

2. Add a Subscriber Account to the Managed Service Provider Account

You can add Subscriber accounts below your tier-1 Service Provider account and below your managed tier-n Service Provider accounts. Each Subscriber account represents a customer account.

To add a Subscriber account to a managed tier-n Service Provider account, from Account Manager:

1. Select the Service Provider account where you want to add the Subscriber account.
2. In the upper, right corner of Account Manager, click .
   

3. In the Account Name text box, type the customer name for the Subscriber account.
4. In the Account Type section, select Subscriber.
5. In the Contact section, add the contact information for the account owner.
   In the Email text box, enter an email address that WatchGuard or you could use to contact the person responsible for the account.
6. (Optional) Add the Mailing Address and Billing Address, if required.
7. Click Save.
8. Repeat these steps for each Subscriber account you want to add.
   

3. Add Operators to the Managed Service Provider Account

Add operators to the managed tier-n Service Provider account so that they can create and manage their own operators. Managed tier-n Service Provider accounts must have at least one Owner operator. You can use a custom operator role to control what permissions the operators in your tier-n Service Provider accounts have. This can be useful to limit management tasks that each operator can perform or to enable or disable specific permissions in feature areas and products.

For more information, go to Manage Custom Operator Roles.

Your operator role determines what you can see and do in WatchGuard Cloud. Your role must have the Manage Tenants permission to add operators to a managed account. For more information, go to Manage WatchGuard Cloud Operators and Roles.

Add operators to your account, and then add operators to the tier-n Service Provider accounts you manage so that they can create and manage their own account and accounts they manage. As the MSP (tier-1 Service Provider), you can see and manage any operators created by tier-n Service Provider accounts that you manage.

To add an operator to a managed account:

1. From Account Manager, select the account you want to add an operator to.
   To add operators to your account, select Overview or My Account. If you select My Account, you will add operators to your Subscriber account.
2. Select Administration > Operators and Roles.
3. On the Operators page, click Add Operator.



4. In the User Name text box, type a user name.
5. In the Email text box, type the email address of the operator.
6. In the First Name and Last Name text boxes, type the first and last name of the operator.
7. To assign permissions to the operator, from the Select Role drop-down list, select an operator role. For information on custom operator roles, go to Manage Custom Operator Roles.
8. To require the operator to authenticate with the AuthPoint app, enable the Multi-Factor Authentication toggle. For more information, go to Enable MFA for WatchGuard Cloud Operators.
   The Confirm Email Address dialog box opens.
9. Click Confirm Email.
10. Click Save.
    WatchGuard Cloud sends an email message to the new operator with a link to set a password.
11. Repeat these steps for each operator you want to add.

MSP with Delegated Tier-1 Subscriber Account

In this scenario, the MSP has a customer (tier-1 Subscriber) that owns a Firebox. As a tier-1 Subscriber, the customer can activate WatchGuard Fireboxes and products in their own WatchGuard account. The tier-1 Subscriber account wants to delegate their account management to the MSP. The MSP can then manage the tier-1 Subscriber account, as well as the products, trials, and inventory for the account.

When delegation is complete, the MSP can allocate products to the tier-1 Subscriber account. The MSP can also view and edit products purchased and managed by the tier-1 Subscriber account. In this scenario, the MSP allocates a Firebox device to the delegated account.

For more information, go to Inventory Management for Tier-1 Subscriber Delegated Accounts.

MSPs can also view and edit Firebox configurations and templates for the delegated tier-1 Subscriber account. This type of Firebox co-management is useful when a customer has purchased their own Firebox but needs assistance with configuration.

Complete these steps:

1. Request Account Delegation from a Tier-1 Subscriber Account.

2. Provide Account Access.

1. Request Account Delegation from a Tier-1 Subscriber Account

To manage a tier-1 Subscriber account, the MSP generates a verification code and sends it to the owner or administrator of the tier-1 Subscriber account. The recipient uses the verification code to approve the access request and delegates management of their account to the MSP.

For more information on account delegation, go to Manage a Delegated Account.

To request account access:

1. From Account Manager, select the account you want to request access for.
2. Select Administration > Overview.
3. Click Request Access to an Account or Request Access (if you already manage delegated accounts, the Managed Access widget is different).

4. On the Managed Access page, click Request Account Access.

5. To generate the verification code, click Next.
6. Click Copy to Clipboard to copy the verification code shown on the page.

7. Send the verification code to the owner of the account you want to access. We recommend that you use the provided text as a template.

2. Provide Account Access

To start the account delegation process, the MSP sends the verification code to the owner of the tier-1 Subscriber account. The owner of the tier-1 Subscriber account uses this verification code to accept the request and provide account access. This procedure is completed by the owner of the tier-1 Subscriber account.

To provide account access and delegate your tier-1 Subscriber account:

1. Log in to WatchGuard Cloud.
   
2. Select Administration > Managed Access.
   The Managed Access page opens.
3. On the Managed Access page, in the Verification Code text box, paste or type the verification code the Service Provider sent to you.

4. Click Submit.
5. Review the details of the request. To approve the account access request, click Grant Access .
   If you cancel, you can still review and approve the access request later. You have 14 days before the verification code expires.

By default, account delegation continues until you or the delegated account remove access.

To support partner business models, tier-1 Service Providers can allocate product licenses and trials to delegated tier-1 Subscriber accounts (for example, Fireboxes, access points, AuthPoint users, and endpoint products and modules). Service Providers can allocate inventory to tier-1 Subscriber accounts as a term or subscription allocation type. This includes term licenses purchased with MSSP Points.

What's Next?

After you create your account structure in WatchGuard Cloud, you can allocate users and endpoints from product license you have activated. For information on how to manage inventory in WatchGuard Cloud, go to Allocate a License in WatchGuard Cloud.

You might also want to:

• Add Fireboxes to WatchGuard Cloud
• Add Device Folders in Account Manager
• Explore Firebox Templates
• Try New Products and Features

For more information on WatchGuard Cloud for Service Providers, review this topic, Best Practices for Service Providers in WatchGuard Cloud.

Add Fireboxes to WatchGuard Cloud

To monitor or manage devices from WatchGuard Cloud, you can add the Firebox to your WatchGuard Cloud account. For more information, go to Get Started — Add a Device to WatchGuard Cloud.

For best practices on how to change your locally-managed Firebox to cloud management, go to the Firebox Migration to Cloud Management Guide.

When you add a Firebox to WatchGuard Cloud, you select how you want to manage the Firebox:

Cloud Management

With this option, you use WatchGuard Cloud for all Firebox configuration management, monitoring, and reporting. You can also set up your devices and configure and manage security and networking policies across multiple Fireboxes with flexible templates.

Local Management

With this option, you use WatchGuard Cloud for monitoring and reporting, and you use Fireware Web UI or WatchGuard System Manager to manage the device configuration.

Add Device Folders in Account Manager

In Account Manager, you can group devices in folders. When you select a folder, the right side of the window shows information about the devices in the folder.

Folders help you to see status and summarized data for groups of devices. For example, you could organize devices at different office locations into separate folders. This enables you to open a folder to see only the devices at that location, and to see summary status and aggregated reports for those devices. Each folder can contain devices, folders, or both.

For more information, go to Device Folders.

Explore Firebox Templates

Firebox templates provide a way to manage shared configuration settings for multiple cloud-managed Fireboxes. Firebox templates can become a "golden configuration" with standard settings that you want to assign to all of your devices.

In a Firebox template, you can configure firewall policies and services just as you would for an individual Firebox. Your cloud-managed Fireboxes can then subscribe to the template. When tier-1 Service Providers create a template, it is available to their managed and delegated accounts and to devices in all accounts below them.

For more information, go to About Firebox Templates.

To use Firebox templates to configure Fireboxes, you must:

• Add the template — Add the template and configure the shared settings. For more information, go to Manage Firebox Templates.
• Deploy the template — Deploy the template so that settings deploy to devices that subscribe the template now or that subscribe to it in the future. For more information, go to Deploy Firebox Templates.
• Subscribe devices to the template — After you add and deploy a template, Fireboxes in your account can subscribe to the template. Service Provider accounts that you manage or have delegated access to can inherit the template. Devices allocated to accounts below more than one Service Provider can subscribe to templates from any tier above them. For more information, go to Subscribe a Firebox to a Template.

Try New Products and Features

You can enhance your experience of WatchGuard Cloud's unified platform with free 30-day product trials. You can also try new features when they become available for beta test.

Free Product Trials

Service Providers can start trials for their account and accounts they manage.

You can start free trials for these products in WatchGuard Cloud:

• AuthPoint
• Compliance Reporting
• Endpoint Security products and modules
• FireCloud
• ThreatSync+ NDR
• ThreatSync+ SaaS

For more information on trials, go to About Trials in WatchGuard Cloud.

ThreatSync

ThreatSync is a WatchGuard Cloud service that provides eXtended Detection and Response (XDR) technology for WatchGuard products. ThreatSync provides extended detection capabilities through the correlation of data from different WatchGuard security products that indicates the presence of threats.

You can enable ThreatSync for your account and any account you manage. For more information, go to Quick Start — Set Up ThreatSync.

ThreatSync+ NDR extends the existing ThreatSync functionality in WatchGuard Cloud and offers enhanced network detection and response, network device identification, and advanced reporting for Fireboxes, third-party firewalls, and LAN infrastructure. To learn more, go to About ThreatSync+ NDR in WatchGuard Cloud Help.

ThreatSync+ SaaS enables you to monitor, detect, and report on activity from third-party SaaS and cloud environments, such as Microsoft 365. To learn more, go to About ThreatSync+ SaaS Integration — Microsoft 365 in WatchGuard Cloud Help.

Beta Features

The Beta Features page shows beta features and applications that you can preview and test. Only operators with Administrator or Owner permissions can enable or disable a beta feature. You cannot enable beta features for a delegated account, unless it is a delegated tier-1 Subscriber account.

For more information, go to Enable Beta Features and Applications.

Questions?

WatchGuard Support is available to answer any questions and provide the information you need to get the most out of WatchGuard Cloud. When you contact WatchGuard Support, your Support representative might ask you to enable support access in WatchGuard Cloud. For Service Providers, when you enable access to Support (Auditor or Owner roles), they have access to your account and any accounts you manage. For more information, go to Support Access to WatchGuard Cloud Accounts.

Related Topics

Get Started — Add a Device to WatchGuard Cloud

About WatchGuard Licensing

Best Practices for Service Providers in WatchGuard Cloud