Managed accounts let a reseller or MSP provision and operate multiple customer certificate estates without maintaining separate logins for each customer. From your parent workspace you create child workspaces for each customer, grant your staff the access level they need for each customer, and switch between customer contexts from the workspace switcher — all without asking customers to share their credentials.

​
What it is

Your workspace becomes a parent that can hold any number of child workspaces. Each child workspace is a fully independent certificate estate — its own certificates, agents, CA integrations, and alert rules. You grant parent-side users either viewer or admin access to each child. A viewer can read the child’s certificate inventory without making changes; an admin can configure everything in the child. Child-side members do not see the parent hierarchy.

​
When to use it

  • Provision a new customer workspace from your MSP dashboard without asking the customer to self-register.
  • Give a junior analyst viewer access to a customer’s estate for monitoring without the risk of accidental configuration changes.
  • Separate billing tiers across customers by assigning each child workspace a reseller tier label.
  • Conduct a quarterly certificate review across all customers from a single workspace-switcher context without separate logins.
  • Revoke a staff member’s access to a customer workspace immediately when they leave the team.

​
Set it up

1

Open Managed Accounts

Go to Settings > Managed Accounts from your parent workspace.
2

Create a child workspace

Click New customer workspace. Enter the customer name, a URL-friendly slug, and an optional reseller tier label. The workspace is created immediately.
3

Grant access to your staff

Click Manage access next to the new child workspace. Add a user from your parent workspace and choose Viewer or Admin. Click Save. The user can now switch into the child workspace from the workspace switcher.
4

Switch to the customer context

Use the workspace switcher in the top navigation to move into the child workspace. The full TigerTrust interface reloads scoped to that customer’s estate.
5

Update or revoke a grant

Return to Settings > Managed Accounts, find the child, and click Manage access to change a role or remove a user’s access.

​
What you’ll see

The Managed Accounts page lists all child workspaces with their name, reseller tier, and the number of access grants. Clicking a child shows the grant list with roles and the last time each user accessed that workspace. The parent workspace audit log records all child creation and grant changes.
Deleting a child workspace permanently removes all of its certificates, agents, and audit history. This action cannot be undone. The parent audit log records the deletion event.

​
Tips

  • Issue separate API keys for each child workspace when integrating programmatically — do not share a single key across customers.
  • The audit log in each child workspace is independent; the parent audit log captures management operations (creation, deletion, grant changes) but not day-to-day activity inside the child.

API Key Rotation

Issue and rotate separate API keys per child workspace.

RBAC

Role definitions that apply within each workspace.