A UniFi console controls the firewall, Wi-Fi, switching and often cameras and door access for a whole site, so its admin accounts and firmware versions deserve the same care as a firewall's. Ubiquiti UniFi is widely used by small and medium businesses, managed service providers, schools and prosumers, and its consoles (Dream Machines, Cloud Gateways, Cloud Keys and UniFi OS Server) sit at the edge of the network, and securing them is a shared responsibility: Ubiquiti ships firmware and settings, and the customer controls admin accounts, remote access and update timing. This guide covers how admin identity works in UniFi, role design, SSH and device credentials, integrations, logging to a SIEM, a hardening baseline and the misconfigurations seen most often. It is for network administrators, MSP engineers and security teams, and applies the general principles in the Edge Device Security Guide to UniFi specifically.
This is an independent guide from NHI Mgmt Group, based on Ubiquiti's public documentation as of November 2026. It is not sponsored or reviewed by Ubiquiti. Product features change, so confirm settings against Ubiquiti's current documentation.
Key takeaways
- Treat Owner and Super Admin as the keys to the site. Ubiquiti says Super Admins should be treated as equivalent to Owners from a security standpoint: they can restore backups and configure SSH.
- Cloud accounts have mandatory MFA, local accounts do not. All UI Accounts must use MFA since 22 July 2024, but MFA is not required for local logins with local credentials, so local admin accounts need strong unique passwords and tight network restrictions.
- Patch UniFi OS like a firewall. Apply Ubiquiti security updates promptly to every console, and track Ubiquiti's security advisory bulletins.
- Close SSH unless support asks for it. Console SSH is off by default and Ubiquiti recommends using it only when instructed by its support engineers; adopted network devices have SSH on by default with a random credential you should review.
- Send activity logs to a SIEM. UniFi exports admin, firewall, intrusion prevention and honeypot events in Common Event Format, which is the only practical way to see admin changes and attacks across sites.
How identity and access work in UniFi
UniFi uses role-based access control and separates admins, who manage infrastructure, from users or members, who consume services such as Wi-Fi, VPN and door access and cannot reach the management interface. Admins reach a console in two ways: through Site Manager, Ubiquiti's cloud portal, using a UI Account; or through the local interface on the console, which also works offline.
| Identity type | Where it is defined | Authentication | Security point |
|---|---|---|---|
| UI Account (cloud admin) | account.ui.com, invited to sites or Fabrics | Password plus mandatory MFA (UI Verify push, authenticator app or email) | Strongest by default; compromise reaches every site the account can manage |
| Local admin | Added in the Network application when remote management is disabled | Local credentials; MFA not required for local logins | Only safe if management is reachable from a restricted network |
| Identity provider groups | Mapped to admin roles in Fabrics | Your IdP's policies | Joiners and leavers follow group membership instead of manual edits |
| Device SSH credential | UniFi Network > UniFi Devices > Device Updates and Settings > Device SSH Authentication | Random string generated by UniFi | One credential across adopted devices; review and restrict |
| Factory default credentials | Before setup or adoption | root / ui for consoles and gateways, ui / ui for network devices (ubnt on older devices) | Unadopted devices on a reachable network are open to anyone |
UniFi Fabrics let you define roles once and apply them across many sites, with granular permissions, several roles per admin and mapping of roles to identity provider groups. Without Fabrics, Site Manager assigns permissions per application and, with the Site Specific option, per site. Every admin added through Site Manager needs their own UI Account: shared accounts make MFA, audit and offboarding meaningless.
MFA on UI Accounts
Ubiquiti made MFA mandatory for all UI Accounts on 22 July 2024; accounts with no method were switched to email authentication. Supported methods include the UI Verify app, third-party authenticator apps and email, with backup recovery codes. Ubiquiti cannot reset MFA: a user who loses every method must create a new account. For admins, register at least two app-based methods, store recovery codes in a password manager, and avoid email as the only factor, because a compromised mailbox then defeats MFA. See the MFA Guide and the MFA backup codes and recovery codes guide.
Admin roles and privileged access
| Role | Scope | Treat as | Recommended holders |
|---|---|---|---|
| Owner | Account that set up the console; highest access, some owner-only features | Break-glass | A company-owned account with a role mailbox, not an individual's or an installer's personal account |
| Super Admin | Full site administration including backup restore and SSH configuration | Equivalent to Owner | Two or three named senior administrators |
| Admin with per-application permissions | Chosen applications and sites | Privileged | Day-to-day network staff, scoped to the applications and sites they run |
| Hotspot Operator (Network) | Guest Wi-Fi hotspot management | Limited | Reception or front desk staff |
| Door Attendant (Access) | Opening doors and talking to visitors | Limited, but physical security impact | Security or reception staff |
- Own the Owner account: a common SMB failure is that the installer or MSP created the console with their personal UI Account. Transfer ownership to an organisation-controlled account during handover, and record it in your privileged account inventory.
- Separate daily admin from Super Admin: give most staff application-scoped admin roles; keep Super Admin for the few who need backup restore and SSH.
- Use Allow Remote Management deliberately: when adding a local admin in the Network application, Allow Remote Management is optional. Leave it off for local-only accounts so they cannot be used through the cloud path.
- MSP access: give each MSP engineer their own UI Account with MFA and a role limited to the sites they support, and review the list quarterly. A shared "support" login cannot be attributed or revoked per person. See the Choosing an IT Support Provider or MSP Securely guide if your provider has admin access.
- Offboarding: removing someone from the organisation's IdP does nothing for a UI Account invited directly. Either map roles to IdP groups through Fabrics or add UniFi admin removal to your leaver checklist.
Choosing a management model
| Model | Strengths | Risks | Fits |
|---|---|---|---|
| Site Manager with UI Accounts | Mandatory MFA, central view across sites, works for remote staff | Account compromise reaches all sites; depends on Ubiquiti cloud availability | MSPs and multi-site businesses |
| Fabrics with IdP group mapping | Roles defined once, automatic joiners and leavers | IdP group hygiene becomes part of network security | Larger estates with an existing IdP |
| Local-only management | No cloud dependency, management stays on site | No MFA on local logins; remote work needs a VPN | Regulated or isolated sites with an admin VLAN and VPN |
Integrations, API tokens and service accounts
- Integration accounts: monitoring tools, hotspot portals, home automation and RMM platforms often log in to UniFi with a dedicated account. Because local logins do not require MFA, these accounts are attractive targets. Give each integration its own account or API key, with the smallest role that works, and record the owner and purpose.
- API keys: Ubiquiti publishes official APIs, including the Site Manager API for monitoring and managing deployments at scale. Treat any key as a non-human identity: store it in a secrets manager, not in scripts or automation platform notes, rotate it when staff or vendors change, and revoke it when the integration ends. See the API Key Management Guide.
- Identity provider and SAML: UniFi supports SAML single sign-on for end-user services such as Wi-Fi, VPN and door access. Federating these to your IdP removes shared Wi-Fi passwords and lets you disable a leaver everywhere at once.
- Alarm Manager webhooks: Alarm Manager can send push, email and webhook (GET or POST) notifications. Webhook URLs often embed secrets for the receiving service; keep them out of shared documentation and use HTTPS endpoints you control.
- Backups: console backups contain the full configuration, including network and VPN settings. Restricting backup restore to Super Admins is one reason that role equals Owner. Store backup files encrypted and limit who can download them.
Logging and detection
UniFi exports activity logs to a SIEM or syslog server from Settings > Control Plane > Integrations > Activity Logging: choose SIEM Server, select categories and enter the server IP address and port. Exported events use Common Event Format, with UniFi-specific extension keys prefixed UNIFI (for example category, host, client MAC and admin) and the vendor shown as Ubiquiti.
| Category | Example events | Detection use |
|---|---|---|
| System: Admin Activity | Admin configuration changes | Alert on changes outside change windows, new admins, SSH enabled, firewall rules removed |
| Security: Firewall | Blocked by Firewall | Scanning and blocked access to management networks |
| Security: Intrusion prevention | Threat Detected and Blocked | Exploitation attempts against internal hosts or the console |
| Security: Honeypot | Honeypot triggered | High-confidence sign of internal reconnaissance |
| Monitoring: client activity | Connect, disconnect, roaming | Unknown devices on staff or management networks |
| System: device, VPN, network | VPN and device events | VPN logins at unusual times, devices going offline unexpectedly |
Ubiquiti does not state a retention period for exports, so retention is whatever your SIEM keeps. Set at least 90 days, longer if regulation requires. See the SIEM Guide.
Metrics: days from a UniFi security advisory to all consoles patched; number of Super Admins and Owners per site (target three or fewer); admin accounts without an identified owner (target zero); consoles with SSH enabled (target zero outside support cases); share of sites forwarding activity logs to the SIEM (target 100%).
| Threat | ATT&CK | UniFi control |
|---|---|---|
| Attempts against UniFi OS from the network | T1190 Exploit Public-Facing Application | Patch to fixed versions, restrict management access, IPS |
| Logging in with factory defaults on unadopted devices | T1078.001 Default Accounts | Adopt immediately, isolate provisioning network |
| Password guessing against local logins | T1110 Brute Force | Strong unique local passwords, management VLAN, UI Accounts with MFA |
| Abusing remote access or VPN | T1133 External Remote Services | MFA, per-person accounts, VPN event monitoring |
| SSH to devices with the shared credential | T1021.004 SSH | Console SSH off, device SSH credential reviewed, management network only |
Hardening baseline
- Inventory and patch. List every console, gateway, switch and access point with firmware version. Apply Ubiquiti security updates promptly, using the security advisory bulletins Ubiquiti posts on its UniFi releases page to confirm the fixed version for each console model. Our recommendation (NHI Mgmt Group): subscribe to those bulletins and record each console's firmware version in your asset inventory.
- Fix ownership and roles. Move the Owner to an organisation-controlled account, cut Super Admins to the minimum, give everyone else scoped roles, and remove former staff and vendors.
- Enforce strong admin authentication. Use UI Accounts with at least two MFA methods for cloud access; give any local admin a long unique password stored in a password manager and leave Allow Remote Management off unless needed.
- Isolate management. Put consoles and device management on a dedicated management VLAN, block access to the management interface from guest, IoT and user networks with firewall rules, and never expose the console's management interface directly to the internet. See the Network Segmentation Guide.
- Close SSH. Keep console SSH off (Settings > Control Plane > Console). Review the Device SSH Authentication credential for adopted devices, change it from the generated value if your policy requires, and use the Debug Console (Settings > System > Advanced > Debug Tools) when support needs diagnostics.
- Adopt devices safely. Adopt new devices promptly on an isolated provisioning network, because unadopted devices accept factory default credentials.
- Turn on detection. Enable intrusion prevention where your gateway supports it, configure honeypots on internal networks, and export Admin Activity, Firewall, Intrusion prevention and Honeypot categories to your SIEM.
- Test and keep rollback. Take and securely store a backup before firmware and firewall changes, pilot firmware on one site or a lab console, and confirm management access from the admin VLAN before removing other access paths so you do not lock yourself out.
Common misconfigurations
- Installer owns the console: the person who set it up leaves, and the organisation can no longer manage its own network or remove their access.
- Too many Super Admins: granting Super Admin for convenience gives backup restore and SSH control to people who only needed to manage Wi-Fi.
- Shared local admin for integrations and staff: one local account without MFA, known to staff, an MSP and a monitoring tool, cannot be rotated without breaking things, so it never is.
- Management reachable from guest or IoT networks: the 2026 UniFi OS flaws require only network access, so any compromised device on a flat network can reach the console.
- Delayed firmware updates: consoles left on old UniFi OS versions because "Wi-Fi works" miss security fixes Ubiquiti has already released.
- No log export: without SIEM forwarding, admin changes and blocked attacks are visible only to someone who happens to look at the console.
Framework mapping
| Control area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | CIS Controls v8.1 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|---|
| Admin roles and least privilege | AC-6 Least Privilege; AC-2 Account Management | PR.AA-05 | Control 5 Account Management; Control 6 Access Control Management | A.8.2 Privileged access rights |
| MFA for admins | IA-2 Identification and Authentication | PR.AA-05 | Control 6 | A.8.5 Secure authentication |
| Firmware patching | SI-2 Flaw Remediation; RA-5 Vulnerability Monitoring and Scanning | PR.PS-02; ID.RA-01 | Control 7 Continuous Vulnerability Management | A.8.8 Management of technical vulnerabilities |
| Management isolation and baseline | SC-7 Boundary Protection; CM-2 Baseline Configuration | PR.IR-01 | Control 4 Secure Configuration; Control 12 Network Infrastructure Management | A.8.20 Networks security; A.8.22 Segregation of networks |
| Log export and review | AU-6 Audit Record Review, Analysis, and Reporting | DE.CM-09 | Control 8 Audit Log Management | A.8.15 Logging |
Practitioner checklist
- Confirm every UniFi OS console runs a version that includes the fixes in Ubiquiti's latest security advisory bulletins.
- Transfer console ownership to an organisation-controlled UI Account with at least two MFA methods.
- Reduce Super Admins to three or fewer per site and give all other admins scoped roles.
- Give every person and every integration its own account; remove shared and former staff or vendor accounts.
- Leave Allow Remote Management off for local-only admins and store local passwords in a password manager.
- Place management on a dedicated VLAN unreachable from guest, IoT and user networks, and never expose it to the internet.
- Keep console SSH off and review the Device SSH Authentication credential.
- Forward Admin Activity, Firewall, Intrusion prevention and Honeypot events to the SIEM and alert on admin changes.
- Store API keys and webhook URLs in a secrets manager with a named owner.
- Back up configuration before changes and keep backups encrypted with restricted access.
Standards and references
- Ubiquiti Help Center: UniFi Roles Explained, Admins and Users
- Ubiquiti Help Center: Adding administrators to UniFi
- Ubiquiti Help Center: Multi-factor authentication for UI Accounts
- Ubiquiti Help Center: Connecting to UniFi with SSH
- Ubiquiti Help Center: UniFi activity logging and SIEM integration
- Ubiquiti: UniFi releases and security advisory bulletins
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Edge Device Security Guide · Network Segmentation Guide · MFA Guide · Patch Management Guide