diff --git a/inventory/group_vars/mbs_backend_stg b/inventory/group_vars/mbs_backend_stg
index 190a72df27..1fb5ca1373 100644
--- a/inventory/group_vars/mbs_backend_stg
+++ b/inventory/group_vars/mbs_backend_stg
@@ -10,7 +10,7 @@ tcp_ports: [ 3000, 3001, 3002, 3003,
              3004, 3005, 3006, 3007 ]
 
 fas_client_groups: sysadmin-noc,sysadmin-releng,sysadmin-mbs,sysadmin-veteran
-ipa_client_shell_groups: sysadmin-mbs
+ipa_client_shell_groups: sysadmin-noc,sysadmin-releng,sysadmin-mbs,sysadmin-veteran
 
 # These people get told when something goes wrong.
 fedmsg_error_recipients:
diff --git a/inventory/group_vars/mbs_frontend_stg b/inventory/group_vars/mbs_frontend_stg
index 4177b2ac1c..3e805c241c 100644
--- a/inventory/group_vars/mbs_frontend_stg
+++ b/inventory/group_vars/mbs_frontend_stg
@@ -17,6 +17,7 @@ tcp_ports: [ 80 ]
 custom_rules: [ '-A INPUT -p tcp -m tcp -s 10.5.126.13 --dport 873 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT' ]
 
 fas_client_groups: sysadmin-noc,sysadmin-releng,sysadmin-mbs,sysadmin-veteran
+pa_client_shell_groups: sysadmin-noc,sysadmin-releng,sysadmin-mbs,sysadmin-veteran
 
 # These are consumed by a task in roles/fedmsg/base/main.yml
 fedmsg_certs: