Working with multiple accounts under a single login

If your organization manages multiple client or site accounts, you can simplify access to the Secure Endpoint Console by using a single set of credentials for all Absolute accounts through a pan-tenant login configuration. This setup is particularly useful for Managed Service Providers (MSPs) that support numerous clients, or for enterprises that maintain separate accounts for different business units, regions, or subsidiaries.

Pan-tenant login functionality is available only to customers whose account configuration supports a parent–child structure, and must be enabled by Absolute during account setup.

In a pan-tenant configuration, a designated parent account controls access across all related child accounts. Administrators in the parent account define which users can log in with shared credentials and specify their role-based permissions for all child accounts. After access is configured, users sign in to the parent account as usual and can then switch between available child accounts directly from the console. This configuration allows users to move between accounts without logging out or maintaining separate credentials, while each account continues to enforce its own data boundaries.

In a pan-tenant environment, each customer hierarchy consists of one parent account and one or more child accounts. The parent account serves as the central point for authentication and user management, while child accounts are used for operational activities such as managing device groups and performing device actions.

Each email address can be associated with only one Salesforce Community (SFDC) account. Once an email address is linked to a parent or child account in SFDC, that association cannot be changed or reused for another account.

The following table summarizes the key functional differences between parent and child accounts:

Functionality Parent account Child account
EUSA acceptance ✔ Accepted once per hierarchy

✘ Automatically inherited

EUSA acceptance is inherited only if the child account has the same expected EUSA version as the parent. Child accounts added after the parent’s acceptance must complete their own EUSA acceptance.
Login access

✔ Central authentication point for all accounts

 ✘ Users cannot log in directly
User authentication settings ✔ Managed centrally ✘ Not available
User invitation and provisioning ✔ Managed centrally ✘ Not available
User editing and deletion ✔ Managed centrally ✘ Limited to device group assignment only
Role management ✔ Create, edit, delete roles ✘ Roles are view-only
API token management ✔ For SCIM integration ✔ For device management actions
Device group management ✘ Not available ✔ Full management allowed
Device management and actions ✘ Not available ✔ Full operational use

The parent account serves as the administrative hub for managing pan-tenant settings and users. From here, you can configure access, define user roles, and connect integrations that apply across your organization’s hierarchy.

To access the parent account:

  1. Log in to the Secure Endpoint Console with an account that is configured for pan-tenant access.

  2. Under Choose an account, select the account listed first.

    The parent account is always listed first, followed by all associated child accounts.

  3. From the navigation bar at the left side of the page, select the area you want to work in (by default, the Users area is shown when you log in).

    Navigation bar icon Area What can you do?
    Users

    Manage who in your organization has pan-tenant access to the Secure Endpoint Console. Learn more

    Users added in this area inherit access to all accounts within your pan-tenant environment, including the parent account and all associated child accounts. Access levels and permissions for each user can be managed through role-based settings.

    When managing users in a pan-tenant environment, keep the following points in mind:

    • The Assigned accounts column in the user list shows which accounts each user is associated with within your hierarchy.
    • Users who were added to child accounts before the parent–child hierarchy was created must be re-invited from the parent account so they can log in again.
    • If a child account is removed from the hierarchy, all users from that account are automatically removed to prevent duplicate email addresses across accounts.
    Roles Create and edit roles to control user permissions and access levels that apply consistently across all pan-tenant accounts. Learn more
    Authentication Control how users authenticate to the Absolute accounts in your pan-tenant environment. Learn more

    Events

    View a log of the events associated with the parent account that were triggered by a user or the system.

    You can view details about each event, search for a particular event of interest, and filter the page based on one or more criteria. By default, the page shows events over the past 7 days, but you can update the page's filters to show up to 365 days of event history.

    To see events associated with a child account, you must switch to that account and click History > Events on the navigation bar.

    API management

    Create and manage API tokens for SCIM integration to provision users automatically from your identity provider (IdP). Learn more

    SIEM integration

    		Configure integration with your Security Information and Event Management (SIEM) platform to consolidate, view, and analyze events from all accounts within your pan-tenant environment. Learn more

    Settings

    Access the following features:
    When you access the Help system from within the parent account, some topics may describe functionality or areas that are available only in child accounts, since many operational features are accessible only when you’re working in a child account.

Child accounts represent individual clients, business units, or sites within your organization’s pan-tenant configuration. From a child account, you can manage devices, view events, and perform account-specific actions that apply only to that account’s data and settings.

When working in a child account, note that the following areas of functionality are not available:

  • User authentication settings

  • User invitation and provisioning

  • User editing and deletion

  • Role management

These settings and features are managed from the parent account and apply consistently across all accounts in your pan-tenant environment.

Email deep links are not currently supported for child accounts. If you receive an email that includes a link to a console page in a child account, the link may not open the correct page. Support for deep links in child accounts will be added in a future release.

To access a child account:

  1. Log in to the Secure Endpoint Console with an account that is configured for pan-tenant access.

  2. Under Choose an account, select the name of the child account you want to access.

    The parent account is always listed first, followed by all associated child accounts.

    The Dashboards area of the child account opens.

One of the advantages of a pan-tenant configuration is the ability to move seamlessly between accounts without signing out. From the console, you can select a different account at any time to view or manage its data, settings, or devices. Each account maintains its own data boundaries, even when you switch between accounts.

You can work in multiple accounts at the same time by opening each account in a separate browser tab or window.

To switch between accounts:

  1. On the navigation bar, click Settings.

  2. Click Switch accounts under your account information in the menu.

  3. Under Choose an account, select the name of the account you want to access.

    The parent account is always listed first, followed by all associated child accounts.