Applies To: WatchGuard Cloud
Some of the features described in this topic are available only to participants in the WatchGuard Cloud Beta program. If a feature described in this topic is not available in your version of WatchGuard Cloud, it is a beta-only feature.
When a tier-1 Subscriber account or a tier-n Service Provider account delegates access to their account, the managing Service Provider can start trials and allocate inventory for the delegated account. Delegation is not available for tier-n Subscriber accounts. For information on how to manage a delegated account, go to Manage Delegated Account Access — Service Providers.
Manage Inventory and Trials in Delegated Accounts
To support partner business models, Service Providers can allocate trials and commercial licenses for WatchGuard products to delegated accounts (for example, Fireboxes, access points, AuthPoint users, and Endpoint Security products and modules). The managing Service Provider account can allocate inventory to the delegated account as a Term or Subscription allocation type. This includes term licenses purchased with MSSP Prepaid Points.
Service Providers cannot reallocate inventory from one managed account to a delegated account. They can only allocate inventory from their Service Provider account to the delegated account.
For example, Service Providers can use delegated inventory to address these inventory challenges:
- FlexPay Subscriptions — Use FlexPay subscriptions to deploy licenses to any account they manage, including delegated tier-1 Subscriber accounts.
- On-boarding — Quickly and easily on-board new customers, even if the customer already has their own WatchGuard Cloud account.
- Module Licensing — Add Endpoint Security module licenses to customer accounts, even if the customer owns the original base product (for example, Endpoint Security Prime and Patch Management). You can also enable management access for WatchGuard Orion for your delegated tier-1 Subscriber accounts.
Service Providers can allocate more of an existing product as well as new products to the inventory that the delegated account already has. For example, a delegated tier-1 Subscriber account can also allocate inventory to their own account. On the Inventory > Allocation page, the managing Service Provider can view the inventory that the delegated account allocated to their own account, but they cannot edit the inventory allocation.
In this image, there are two allocations of the same product to a tier-1 Subscriber account. The first allocation is from the managing Service Provider account. To edit the allocation, the Service Provider can click the account name. The second allocation was made by the delegated tier-1 Subscriber account and the Service Provider cannot edit it.
Inventory must be de-allocated from the delegated account before you can remove delegated access. For information on how to remove delegated access, go to Remove Access.
You cannot remove account delegation if there are devices in the delegated account that subscribe to a Firebox template inherited from your account.