When a UniFi network goes live, the client — not the installer — should end up holding the primary account on the console, a current configuration backup, a documentation set describing the network, and a clear answer about how any remote-support access can be removed later. If any of those pieces is missing at signoff, the homeowner or property manager does not fully control the network, even if every camera and access point is working. This matters most the day a relationship with an integrator ends, because recovering an unclear network setup afterward is slower than confirming access up front.
Who should hold the primary account on the console?
Before an installer finishes a project, a client should confirm in writing which account is the primary account on the UniFi console, and should not accept an arrangement where the only account with that status belongs to the integrator. Ask your contractor directly how account roles and permissions are structured on your specific hardware and UniFi OS version, since this is a question to raise with your installer rather than something to assume.
UniFi's cloud gateway platform supports secure multi-factor authentication, "including our seamless single-touch solution with UI Verify (iOS/Android)," according to UniFi Cloud Gateways - Ubiquiti. Whichever account controls the network should have MFA enabled on its own credentials, not credentials shared with the installer, so the client retains a working login independent of the firm that built the network.
What backups should exist, and where?
UniFi Cloud Gateways support "Automatic Cloud Backups and Recovery for UniFi OS and UniFi Applications," and migrating a deployment to new hardware is done by restoring a System Config Backup on the replacement console — the documented path for moving between consoles or recovering after a hardware failure, as described on UniFi Cloud Gateways - Ubiquiti. A property owner should know whether that cloud backup is enabled and tied to an account they control, and should also ask for a recent config export kept offline, since a cloud-only backup tied to the installer's account may not be reachable if that relationship ends before login details transfer.
On networks that still run a software-based Network Server on a separate machine rather than a dedicated console, the equivalent "UniFi Network Application Backup" is the file to retain, per the same source. Either way, ask your contractor which backup format applies to your hardware and who is responsible for storing a current copy outside the installer's own systems.
What documentation should a client receive?
CEDIA's wiring guidance treats documentation as part of the installation, not an afterthought: "documentation is essential. Store this securely but accessibly, looking at factors like cable paths, rack layout and network schemes," as stated in The Ultimate Smart Home Wiring Guide | CEDIA, specifically so a future integrator can pick up the system without re-discovering it room by room. For a UniFi network, that translates into a VLAN plan showing how traffic is segmented, a device list mapping switches and access points to physical locations, and a record of camera retention settings if UniFi Protect is part of the installation. A network commissioned with VLANs but no written record of what each VLAN does is harder for a second contractor to service safely, because changing a misunderstood firewall rule can reopen isolation that was deliberately built in.
CEDIA's network security guidance separately recommends VLAN-based traffic segmentation, noting that "VLANs offer a secure solution" for isolating network traffic between zones, per Securing the Residential Network | CEDIA — another reason the VLAN map is worth keeping current as devices are added. If your home or office also runs a structured enterprise network upgrade, ask your integrator to fold that VLAN and device documentation into the same handover package rather than treating it as a separate deliverable.
How should remote-support access be granted and revoked?
An installer providing ongoing support needs some form of account access to the console for day-to-day monitoring, but the specific permission model and how to remove that access later are questions to confirm with your installer in writing before the project closes, not after a dispute. Ask what account(s) the support team uses, whether those accounts are separate from the client's own login, and what the exact steps are for the client to remove that access unilaterally. Test the removal process, if possible, while the relationship is still in good standing.
If a network is already in a state where ownership and access are unclear — an existing UniFi deployment inherited from a prior installer — that is closer to the kind of relationship-rebuilding work Cave Group's networking upgrade service and the related Crestron orphaned-system recovery guide describe for control systems: a site visit, an audit of what access actually exists, and a rebuild of documented ownership from there rather than guessing at an old installer's configuration.
Cave Group designs and commissions UniFi Enterprise networks with VLAN segmentation, local controller management, and documentation handed to the client at project close, and provides ongoing remote monitoring under access terms the client can review.
Frequently asked questions
What account should I hold on my UniFi console after installation?
Confirm with your installer, before the project closes, which account has primary control of your console and ensure that account's credentials and MFA belong to you, not solely to the installer — the exact permission structure should be documented in writing for your specific hardware.
Does UniFi back up its own configuration automatically?
Yes — UniFi Cloud Gateways support automatic cloud backups and recovery for UniFi OS and its applications, and a System Config Backup is the standard file used to migrate or restore a deployment onto new hardware.
Should I keep an offline backup even if cloud backup is enabled?
It is worth asking your contractor for a current config export stored outside the installer's own cloud account, since a cloud backup tied to someone else's login may not be reachable if that relationship ends before access transfers to you.
What documentation should I receive after a UniFi installation?
A VLAN plan, a device list mapping hardware to locations, and camera retention settings if UniFi Protect is installed are reasonable minimums; CEDIA's wiring guidance treats recorded cable paths, rack layout, and network schemes as part of the handover, not an optional extra.
How do I remove a support firm's access when the engagement ends?
Ask your installer in writing, before the project closes, exactly which accounts the support team will use and what steps you can take unilaterally to remove that access later — and confirm the removal process works while the relationship is still in good standing, rather than waiting until you need it.