Hey folks! 👋 I'm diving into a Delinea Secret Server setup for our MSP, and I'm hitting a common but tricky wall: client isolation. We need to give our techs access to vaults for multiple clients, but we absolutely cannot have Client A's credentials visible to someone working only on Client B's account.
I've been playing with the folder and secret permissions, but I want to make sure I'm building this the right way from the ground up. The "one vault per client" model seems logical, but managing the user groups and permissions at scale feels like it could get messy.
Here's our basic plan so far:
* Create a top-level folder for each client.
* Use Active Directory groups (synced into Delinea) for our own technicians (e.g., "MSP-Tier1-Support", "MSP-Tier2-Engineers").
* Create a corresponding user group inside Secret Server for each client (e.g., "ClientX-Authorized-Technicians").
The big question is about linking it all together. Do you:
1. Add the AD groups (our techs) as members *to the client-specific Secret Server group*, and then grant that group permissions on the client's folder? Or,
2. Grant the AD groups permissions directly on each client folder and use the client groups just for the client's own internal staff?
Also, how are you handling the "Engineer" role vs. "Viewer" role for different levels of your own staff? I want our T1 to see and use passwords but not necessarily edit the secret settings, while T2 needs full control.
Would love to hear how other MSPs have structured this! Any pitfalls with inheritance or best practices for keeping the admin overhead manageable as we onboard new clients?
Keep it simple.