Customer Management

This guidance is intended to help:

• Rapid7 Partners who are operating as Managed Security Service Providers (MSSPs) using Rapid7 products for a set of Managed Customer accounts.
• Enterprise or government customers who are using Rapid7 products for multiple sub-entities of their company.

To extend your Primary Account user's access to the accounts they are responsible for managing, you can create managed customer relationships so you can perform these user access management tasks independently.

Establish the managed customer relationship

Before you are able to grant your security analysts access to a Managed Customer account, the Managed Customer must first agree to be managed. This approval process is facilitated through Rapid7.

To create a Managed Customer relationship:

1. You should contact your Rapid7 representative with details for the customer you wish to manage.
2. The Managed Customer needs to have a Command Platform account licensed with one or more Rapid7 products. This can be either:
   • An existing account
   • An account created by request through Rapid7
   • An account created for a Proof of Concept
3. Rapid7 will establish the relationship between your Primary account and the Managed Customer account.
4. The Platform Administrator for the Managed Customer account will receive an email requesting approval for the Primary account to manage customer access.
5. The Platform Administrator should follow the link provided in the email in order to log in to their account and approve the access request.
6. Alternatively, the Platform Administrator can approve the access request by navigating to the Company Settings tab in the left menu. From here, they will select the External User Settings tab and click the green Approve Access button.
7. You are now able to manage the customer account.

Access Customer Management

To manage user access for your managed customers, log in to your Primary customer account on the Command Platform as a Primary account Platform Administrator, then go to Administration > Customer Management

To access a Managed Customer account:

1. Go to Administration > Customer Management > Customers.
2. From here, you can manage which accounts your security analysts can access.
3. You can view all customers that you currently manage, the Rapid7 products they own, as well as the number of users that are assigned to each Managed Customer.
4. For any Managed Customer that has not yet approved the Primary account to manage their account, the account status will appear as pending until they are approved. The pending status is indicated by a yellow, triangular symbol on the Managed Customer name.

Assign user access to a Managed Customer

Any user within your Primary account can be granted access by a Primary account Platform Administrator to any approved Managed Customer.

To assign users to a Managed Customer:

1. Go to Administration > Customer Management > Customers.
2. Click the name of the customer you wish to add user access to.
3. Click Assign User Access.
4. Select the Primary account users you want to grant access by typing the name of the user into the provided field or selecting the user from the dropdown list.
5. Configure the access privileges the users will be given by selecting the following:
   • Determine whether they are to receive Platform Administrator access within the Managed Customer.
   • Determine how long this access is valid for. This can be permanent, meaning until they are removed by Primary account Platform Administrator at some point in the future, or time-bound. For example, 24 hours, 48 hours, or a custom duration.
6. Click Next.
7. You can now assign both a product role and what products the users will have access to within the Managed Customer account.
8. Click Next.
9. Review the Access Request Summary. Use the Back button if changes are required.
10. Click Submit.
11. The user access assigned to the customer will be updated upon refresh.

Assign a user access to one or more Managed Customers

You can assign a user in your Primary account access to multiple Managed Customers

To assign one or more Managed Customer accounts to a user:

1. Go to Administration > Customer Management > Users.
2. Click the name of the user you wish to add customer access to.
3. Click Assign Customer Access.
4. Select the Managed Customers you want to grant the user access to by typing the name of the customer into the provided field or selecting the customer from the dropdown list.
5. Configure the access the user will be given to all chosen customers by selecting the following:
   • Determine whether they are a Platform Administrator.
   • Determine how long this access is valid for. This can be permanent, meaning until they are removed by the Primary account Platform Administrator at some point in the future, or time-bound. For example, 24 hours, 48 hours, or a custom duration.
   • You can choose to add a comment that will be included in an email notifying Platform Administrators in the Managed Customers of a new user receiving access.

6. Click Next.
7. You can now assign both a role and what products the user will have access to within each individual Managed Customer account, starting with the first selected customer and progressing in sequence.
8. Click Next.
9. Review the Access Request Summary. Use the Back button if changes are required.
10. Click Submit.
11. The customer access assigned to the user will be updated upon refresh.

Remove Managed Customer access

To remove Primary account access from a Managed Customer account:

1. Go to Administration > Customer Management > Customers.
2. Locate the customer you wish to delete in the Managed Customers table.
3. Click the minus icon.
4. Click Yes, remove access to confirm.

Use SSO to control multi-tenancy access

To control access for multiple Primary account users across Managed Customers, you can create a Customer Group. User assignment to a Customer Group is controlled through SSO within your Identity Provider, removing the need for your Primary account Platform Administrators to manage this.

When in a Customer Group, you will be able to view and edit the Managed Customers assigned to the Customer Group, as well as the Products and Roles that Primary account users will be assigned for each Managed Customer in that Customer Group. You will also be able to view the Primary account users assigned through your Identity Provider. This is controlled exclusively through the rbacCustomerGroup SAML attribute within your Identity Provider, so this section is not editable.

To create a Customer Group:

1. Go to Administration > Customer Management > Customer Groups.
2. Click Create Customer Group.
3. Enter a name for your Customer Group.
   1. Optionally, enter a description.
   2. Note that the value of the rbacCustomerGroup attribute must match the name of the Customer Group for SSO synchronization to occur.
4. Click Create Customer Group to finish. This will present the Customer Group Profile page where you can define the access for this Customer Group.
5. Click Manage Customers to select the Managed Customers you wish to provide access to within this Customer Group.
   1. Click Save to add these Managed Customers to the Customer Group.
6. Click Manage Group Access to select Rapid7 products your Primary account users will require access to for this Customer Group. If a Managed Customer does not own a product defined in the Customer Group, the Primary account user will have access to this product where available.
   1. For each product you select, a corresponding Role is required prior to saving your changes.
   2. You can also select if a Primary account user has Platform Admin access to the Managed Customer.

Assign users to Customer Groups

Once the required Customer Group has been configured, ensure each Primary account user that requires access has an additional SAML attribute named rbacCustomerGroup, with the value of this attribute matching the name of the Customer Group the Primary account user should be assigned to.

To assign Primary account users to Customer Groups:

1. Go to Administration > Settings > SSO Settings.
2. Click Modify Settings.
3. Under Synchronize IdP Groups with Customer Groups, select IdP customer group synchronization active. You will be presented with a confirmation modal.
4. Click Activate Customer Group Synchronization.
5. Click Submit and turn on SSO.

Any Primary account users signing in through SSO with the rbacCustomerGroup attribute in their SAML assertion will have any existing Managed Customer access removed and will gain the access defined in the Customer Group they are assigned to.

Update Customer Groups

Any updates made to the Customer Group is automatically reflected in the access each Primary account user has. If you add more Managed customers, they can be added to the appropriate Customer Groups and all analysts assigned to these Customer Groups will gain access to the Managed Customer automatically.

To remove a Managed Customer from a Customer Group:

1. Click Managed Customers.
2. Deselect the Managed Customers you want to remove and click Save.

When a Managed Customer is removed from a Customer Group, the analysts assigned to that Customer Group will automatically have their access updated when you click Save.

To change Primary user account access:

Primary account users can only be assigned to one Customer Group at a time. Changing the value of the rbacCustomerGroup SAML attribute assigned to this user will automatically update the access given and is reflected the next time the Primary account user logs in to the Command Platform.

This change can take a few seconds. A notification banner is shown while their access is syncing, followed by a success banner when this sync is complete.

To remove a Primary account user from a Customer Group:

To remove access for a Primary account user for a Customer Group (and therefore any Managed Customers in this Customer Group), it is recommended to change the Primary account user's assertion with a value for the rbacCustomerGroup attribute that does not match any Customer Groups you have.

Duplicate a Customer Group

You can duplicate a Customer Group to quickly reuse existing configurations. Duplicating a Customer Group will copy the Managed Customers and Group Privileges defined by the Customer Group, but does not copy the Primary account users. This is because Primary account users can only be assigned to one Customer Group at a time.

You will also need to create a unique Customer Group name for this duplicated group, as this name will be the value of the rbacCustomerGroup SAML attribute used within your Identity Provider.

Delete a Customer Group

To delete a Customer group, click Delete Group. If this Customer Group has analysts assigned to it, the analysts will lose access to the Managed Groups that were in the Customer Group.

Deactivate Customer Group synchronization

If you want to desynchronize your Identity Provider with your Customer Groups, Primary account users that were previously assigned to a Customer Group retain the access they had at the last sync. To edit Primary account user's access, their Role and Product access must be manually adjusted within the User Management page in each Managed Customer account the user had access to.

Alternatively, the Primary account user's access can be deleted from within the Customer Management section of the Primary account, then reassigned to the Managed Customer with new access privileges.

Remove user access

There are two options for removing user access to a specific Managed Customer account.

Option 1

1. Go to Administration > Customer Management > Users.
2. Locate the user you want to make changes to.
3. Click the user's name or the View User link to see the details of all Managed Customers the user has been assigned access to.
4. To remove the user from a specific Managed Customer, click the minus icon to the right of the customer name.
5. Click Yes, remove access to confirm.

Option 2

1. Go to Administration > Customer Management > Customers.
2. Locate the customer you want to make changes to.
3. Click on the customer's name to view details of all assigned users.
4. Click the minus icon for the user that you wish to remove from the Managed Customer.
5. Click Yes, remove access to confirm.

View user-managed customer assignment

As a Primary account Platform Administrator you can easily view which security analysts are assigned to each of your managed customer accounts.

To view a summary of Managed Customer assignment for all users:

1. Go to Administration > Customer Management > Users.
2. This presents a list of all Primary account users (security analysts) and which Managed Customers they have been currently assigned.

To view a particular user's assignment to Primary account managed customers:

1. Locate the user you wish to view.
2. Click on their name or the View User link.
3. You can now view the user’s email, time zone, and further access details within each Managed Customer.

To view user assignment for a particular Managed Customer from the Customers tab:

1. Navigate to the Customers page within Customer Management.
2. Click on the Customer Name.
3. A list of assigned users is presented, including:
   • User Platform Administrator status within the Managed Customer
   • Product access details
   • Last access time
   • Access status - permanent or time limited

Edit User Access

To update a user’s Platform Administrator status and duration of access in a given managed customer:

1. Go to Administration > Customer Management > Users.
2. Click on the name of a user or the View user link in the Users table.
3. Locate the Managed Customer you would like to edit this user’s access for and click the pencil icon.

This will open a page where you can toggle the Platform Administrator status of the user, as well as alter the duration of their access to the Managed Customer. Once you have made your changes and clicked Next, you’ll be presented with a Summary page.

The Summary page contains an Updated tab that allows you to view how the access connected to this user account will update after your changes have been saved. Request details will contain any updates to the Platform Administrator status or expiration date for the duration of the access. Any change to the expiration date will include an update icon. There is also an Original tab that shows what the initial access for this user was before any changes have been applied.

Edit a managed customer name

Primary account Platform Administrators have the ability to update or change the name of managed customers.

To change the name of a Managed Customer account:

1. Go to Administration > Customer Management > Customers.
2. Click on the customer you wish to rename.
3. Click Edit Customer Details.
4. Enter the new name and click Save.

The customer’s name will now be updated throughout the Command Platform.

Customer Navigation Experience

Upon login to the Command Platform, you will be presented with a Customer table containing all the Managed Customers you have access to, with your Primary account pinned to the top of the table. Platform Administrators for the Primary account will see a Manage Customers button on the top right of the page that links directly to the Customers page in Customer Management.

By clicking on a customer's name in this table, you can navigate to any of your Managed Customers’ Command Platform Home to access their products, as well as User Management and other settings if you have a Platform Administrator role for that customer.

To change which customer you are currently viewing, you can click the View Customer Table link at the top of the page at any time. This will return you to the Select Customer Account table.

Managed Customer Experiences

As explained in the Establish the managed customer relationship section, a Platform Administrator within the Managed Customer must approve any Primary account requests to manage their account. A Platform Administrator within the Managed Customer can also perform two related actions once this relationship has been established in the Company Settings tab:

• They can change their email notification settings. For example, whether they wish to get notified when Primary account user access is granted or removed from their customer account.
• They can remove Primary account access from the customer account. In this case, the Primary account would no longer have authority to grant access to Primary account users for the customer account.

Create a Managed Customer Proof of Concept (POC)

Primary account Platform Administrators can create new Managed Customes for the purpose of performing a free proof of concept (POC) of Rapid7 security solutions. The duration of the POC will be time limited, after which you can reach out to Rapid7 should the managed customer wish to progress to a paid-for service.

To create a new Managed Customer for a POC:

1. Go to Manage Customer Access > Create New Customer.. This will open the Create New Customer form.
2. Enter the Customer Account Details of the new Managed Customer.
3. In the First User Details dropdown menu, select which existing user (linked to your Primary account) will be able to access the new customer you are creating.
4. In the Add Product License section, select the products that you wish to grant to the new Managed Customer for POC evaluation.
5. Select the Data Storage Region where the products will be deployed.
6. Finally, click Create New Customer at the bottom of the form.

The process will take a short time to complete. Upon completion, you will be returned to the Manage Customer Access screen where you will be able to see details of the new Managed Customer that you have created.

The user that has been granted access can then immediately sign in and access the new Managed Customer account using the Select Customer Account table. Additional Primary account users can then be added to this Managed Customer by clicking the Customer Name, then by clicking Assign User Access.

Create a POC for existing Managed Customers

For existing Managed Customers, you can also add new product POCs using Create New Product License:

1. Click the customer name from the Manage Customer Access table.
2. Click Create New Product License.
3. Select the products to add as POCs for the Managed Customer.
4. Select a Product Administrator.
5. Finally, click Create New Product License.

Once the new POC has been created, users can be assigned to the product within the User Management section of the Command Platform by any Platform Administrator.

Extend or purchase a license

In the case that your customer would like to extend their POC or proceed to purchase the product, you can start the process by contacting Rapid7 with a formatted email:

1. Click the customer name from the Manage Customer Access table.
2. For each product, select Extend POC License or Purchase License as required.

This will generate an email with specific product details for your Rapid7 representative.

Delete a Managed Customer

Any Managed Customers that you created for the purpose of a POC can also be deleted. By deleting a Managed Customer, all the products and data associated with that customer will be erased. This includes any users created within that Managed Customer account.

To delete a Managed Customer:

1. Go to Administration > Customer Management > Customers.
2. Click the customer name from the table.
3. Click Delete Customer below the customer’s name.
4. Click Delete Customer to confirm the deletion.

Alternatively:

1. Go to Administration > Customer Management > Customers.
2. Click the trash icon on beside the customer you want to delete.
3. Click Delete Customer to confirm the deletion.