diff --git a/_data/toc.yaml b/_data/toc.yaml
index e8ad049dca..771f3fb5b3 100644
--- a/_data/toc.yaml
+++ b/_data/toc.yaml
@@ -1675,14 +1675,14 @@ manuals:
           title: Docker EE Standard use case
         - path: /ee/ucp/authorization/ee-advanced/
           title: Docker EE Advanced use case
+    - sectiontitle: Access UCP
+      section:
+      - path: /ee/ucp/user-access/
+        title: Web-based access
+      - path: /ee/ucp/user-access/cli/
+        title: CLI-based access
     - sectiontitle: User guides
       section:
-      - sectiontitle: Access UCP
-        section:
-        - path: /ee/ucp/user/access-ucp/
-          title: Web-based access
-        - path: /ee/ucp/user/access-ucp/cli-based-access/
-          title: CLI-based access
       - sectiontitle: Deploy an application
         section:
         - path: /ee/ucp/user/services/deploy-a-service/
diff --git a/ee/ucp/admin/configure/integrate-with-dtr.md b/ee/ucp/admin/configure/integrate-with-dtr.md
index 26eb5b2b7e..503bf6f96b 100644
--- a/ee/ucp/admin/configure/integrate-with-dtr.md
+++ b/ee/ucp/admin/configure/integrate-with-dtr.md
@@ -20,7 +20,7 @@ Docker images and deploy services to UCP using these images.
 Docker UCP integrates out of the box with Docker Trusted Registry (DTR).
 This means that you can deploy services from the UCP web UI, using Docker
 images that are stored in DTR. You can also use a
-[UCP client bundle](../../user/access-ucp/cli-based-access.md) to do the same from the
+[UCP client bundle](../../user-access/cli.md) to do the same from the
 CLI.
 
 If you've configured DTR to use TLS certificates issued by a globally-trusted
diff --git a/ee/ucp/admin/configure/manage-and-deploy-private-images.md b/ee/ucp/admin/configure/manage-and-deploy-private-images.md
index 4a7a6b0078..1c2aa76c75 100644
--- a/ee/ucp/admin/configure/manage-and-deploy-private-images.md
+++ b/ee/ucp/admin/configure/manage-and-deploy-private-images.md
@@ -13,7 +13,7 @@ you can store and manage the images that you deploy to your cluster.
 In this topic, you push an image to DTR and later deploy it to your cluster,
 using the Kubernetes orchestrator.
 
-## Open the DTR web UI 
+## Open the DTR web UI
 
 1.  In the Docker EE web UI, click **Admin Settings**.
 2.  In the left pane, click **Docker Trusted Registry**.
@@ -29,7 +29,7 @@ using the Kubernetes orchestrator.
 1.  In the DTR web UI, click **Repositories**.
 2.  Click **New Repository**, and in the **Repository Name** field, enter
     "wordpress".
-3.  Click **Save** to create the repository. 
+3.  Click **Save** to create the repository.
 
     ![](../../images/manage-and-deploy-private-images-2.png){: .with-border}
 
@@ -43,7 +43,7 @@ To push images to DTR, you need CLI access to a licensed installation of
 Docker EE.
 
 - [License your installation](license-your-installation.md).
-- [Set up your Docker CLI](../../user/access-ucp/cli-based-access.md).
+- [Set up your Docker CLI](../../user-acccess/cli.md).
 
 When you're set up for CLI-based access to a licensed Docker EE instance,
 you can push images to DTR.
@@ -133,7 +133,7 @@ from outside the cluster.
 5.  Click **Create**. When the Kubernetes objects are created,
     the **Load Balancers** page opens.
 6.  Click **wordpress-service**, and in the details pane, find the **Ports**
-    section. 
+    section.
 7.  Click the URL to open the default WordPress home page.  
 
     ![](../../images/manage-and-deploy-private-images-4.png){: .with-border}
diff --git a/ee/ucp/admin/configure/use-your-own-tls-certificates.md b/ee/ucp/admin/configure/use-your-own-tls-certificates.md
index 0e7e96b05d..db62223bc0 100644
--- a/ee/ucp/admin/configure/use-your-own-tls-certificates.md
+++ b/ee/ucp/admin/configure/use-your-own-tls-certificates.md
@@ -8,7 +8,7 @@ ui_tabs:
 - version: ucp-2.2
   orlower: true
 next_steps:
-- path: ../../user/access-ucp/cli-based-access/
+- path: ../../user-access/cli/
   title: Access UCP from the CLI
 ---
 {% if include.version=="ucp-3.0" %}
@@ -35,12 +35,12 @@ automatically trusted by your browser and client tools.
 To ensure minimal impact to your business, you should plan for this change to
 happen outside business peak hours. Your applications will continue running
 normally, but existing UCP client certificates will become invalid, so users
-will have to download new ones to [access UCP from the CLI](../../user/access-ucp/cli-based-access.md).
+will have to download new ones to [access UCP from the CLI](../../user-access/cli.md).
 
 ## Configure UCP to use your own TLS certificates and keys
 
 In the UCP web UI, log in with administrator credentials and
-navigate to the **Admin Settings** page. 
+navigate to the **Admin Settings** page.
 
   In the left pane, click **Certificates**.
 
@@ -51,14 +51,14 @@ Upload your certificates and keys:
 * A `ca.pem` file with the root CA public certificate.
 * A `cert.pem` file with the TLS certificate for your domain and any intermediate public
 certificates, in this order.
-* A `key.pem` file with TLS private key. Make sure it is not encrypted with a password. 
+* A `key.pem` file with TLS private key. Make sure it is not encrypted with a password.
 Encrypted keys should have `ENCRYPTED` in the first line.
 
 Finally, click **Save** for the changes to take effect.
 
 After replacing the TLS certificates, your users won't be able to authenticate
 with their old client certificate bundles. Ask your users to go to the UCP
-web UI and [get new client certificate bundles](../../user/access-ucp/cli-based-access.md).
+web UI and [get new client certificate bundles](../../user-access/cli.md).
 
 If you deployed Docker Trusted Registry, you'll also need to reconfigure it
 to trust the new UCP TLS certificates.
@@ -68,4 +68,4 @@ to trust the new UCP TLS certificates.
 
 Learn about [using your own TLS certificates](/datacenter/ucp/2.2/guides/admin/configure/use-your-own-tls-certificates.md).
 
-{% endif %}
\ No newline at end of file
+{% endif %}
diff --git a/ee/ucp/admin/monitor-and-troubleshoot/index.md b/ee/ucp/admin/monitor-and-troubleshoot/index.md
index ef64e439f3..ff8a3c1a65 100644
--- a/ee/ucp/admin/monitor-and-troubleshoot/index.md
+++ b/ee/ucp/admin/monitor-and-troubleshoot/index.md
@@ -34,11 +34,11 @@ managed by UCP are healthy or not.
 ![UCP dashboard](../../images/monitor-ucp-1.png){: .with-border}
 
 Each node has a status message explaining any problems with the node.
-In this example, a Windows worker node is down. 
+In this example, a Windows worker node is down.
 [Learn more about node status](troubleshoot-node-messages.md).
 Click the node to get more info on its status. In the details pane, click
 **Actions** and select **Agent logs** to see the log entries from the
-node. 
+node.
 
 {% elsif include.version=="ucp-2.2" %}
 
@@ -52,7 +52,7 @@ Learn how to [monitor the cluster status](/datacenter/ucp/2.2/guides/admin/monit
 {% if include.version=="docker-cli-linux" %}
 
 You can also monitor the status of a UCP cluster using the Docker CLI client.
-Download [a UCP client certificate bundle](../../user/access-ucp/cli-based-access.md)
+Download [a UCP client certificate bundle](../../user-access/cli.md)
 and then run:
 
 ```bash
@@ -81,7 +81,7 @@ If you're accessing the `_ping` endpoint through a load balancer, you'll have no
 way of knowing which UCP manager node is not healthy, since any manager node
 might be serving your request. Make sure you're connecting directly to the
 URL of a manager node, and not a load balancer. In addition, please be aware that
-pinging the endpoint with HEAD will result in a 404 error code. It is better to 
+pinging the endpoint with HEAD will result in a 404 error code. It is better to
 use GET instead.
 
 {% endif %}
diff --git a/ee/ucp/admin/monitor-and-troubleshoot/troubleshoot-configurations.md b/ee/ucp/admin/monitor-and-troubleshoot/troubleshoot-configurations.md
index 285aacb9b8..66f3f1c639 100644
--- a/ee/ucp/admin/monitor-and-troubleshoot/troubleshoot-configurations.md
+++ b/ee/ucp/admin/monitor-and-troubleshoot/troubleshoot-configurations.md
@@ -40,7 +40,7 @@ sudo apt-get update && sudo apt-get install curl jq
 ```
 
 1. Use a client bundle to authenticate your requests.
-[Learn more](../../user/access-ucp/cli-based-access.md).
+[Learn more](../../user-access/cli.md).
 
 2. Use the REST API to access the cluster configurations. The `$DOCKER_HOST`
    and `$DOCKER_CERT_PATH` environment variables are set when using the client
@@ -143,11 +143,11 @@ VERSION=$(docker image ls --format '{{.Tag}}' docker/ucp-auth | head -n 1)
 # number of replicas equal to the number of manager nodes in the cluster.
 docker container run --rm -v ucp-auth-store-certs:/tls docker/ucp-auth:${VERSION} --db-addr=${NODE_ADDRESS}:12383 --debug reconfigure-db --num-replicas ${NUM_MANAGERS} --emergency-repair
 
-time="2017-07-14T20:46:09Z" level=debug msg="Connecting to db ..." 
-time="2017-07-14T20:46:09Z" level=debug msg="connecting to DB Addrs: [192.168.1.25:12383]" 
-time="2017-07-14T20:46:09Z" level=debug msg="Reconfiguring number of replicas to 1" 
-time="2017-07-14T20:46:09Z" level=debug msg="(00/16) Emergency Repairing Tables..." 
-time="2017-07-14T20:46:09Z" level=debug msg="(01/16) Emergency Repaired Table \"grant_objects\"" 
+time="2017-07-14T20:46:09Z" level=debug msg="Connecting to db ..."
+time="2017-07-14T20:46:09Z" level=debug msg="connecting to DB Addrs: [192.168.1.25:12383]"
+time="2017-07-14T20:46:09Z" level=debug msg="Reconfiguring number of replicas to 1"
+time="2017-07-14T20:46:09Z" level=debug msg="(00/16) Emergency Repairing Tables..."
+time="2017-07-14T20:46:09Z" level=debug msg="(01/16) Emergency Repaired Table \"grant_objects\""
 ...
 {% endraw %}
 ```
diff --git a/ee/ucp/admin/monitor-and-troubleshoot/troubleshoot-with-logs.md b/ee/ucp/admin/monitor-and-troubleshoot/troubleshoot-with-logs.md
index ff966b0d60..810f727081 100644
--- a/ee/ucp/admin/monitor-and-troubleshoot/troubleshoot-with-logs.md
+++ b/ee/ucp/admin/monitor-and-troubleshoot/troubleshoot-with-logs.md
@@ -39,7 +39,7 @@ specially useful if the UCP web application is not working.
 
     When using the Docker CLI client, you need to authenticate using client
     certificates.
-    [Learn how to use client certificates](../../user/access-ucp/cli-based-access.md).
+    [Learn how to use client certificates](../../user-access/cli.md).
     If your client certificate bundle is for a non-admin user, you won't have
     permissions to see the UCP system containers.
 
diff --git a/ee/ucp/ucp-architecture.md b/ee/ucp/ucp-architecture.md
index 63880b289f..2ea7c17795 100644
--- a/ee/ucp/ucp-architecture.md
+++ b/ee/ucp/ucp-architecture.md
@@ -161,7 +161,7 @@ UCP also exposes the standard Docker API, so you can continue using existing
 tools like the Docker CLI client. Since UCP secures your cluster with role-based
 access control, you need to configure your Docker CLI client and other client
 tools to authenticate your requests using
-[client certificates](user/access-ucp/index.md) that you can download
+[client certificates](user-access/index.md) that you can download
 from your UCP profile page.
 
 {% endif %}
diff --git a/ee/ucp/user/access-ucp/cli-based-access.md b/ee/ucp/user-access/cli.md
similarity index 98%
rename from ee/ucp/user/access-ucp/cli-based-access.md
rename to ee/ucp/user-access/cli.md
index d0a4d49740..5598c1a3a1 100644
--- a/ee/ucp/user/access-ucp/cli-based-access.md
+++ b/ee/ucp/user-access/cli.md
@@ -12,6 +12,7 @@ next_steps:
   title: Deploy a service
 redirect_from:
   - /datacenter/ucp/3.0/guides/user/access-ucp/cli-based-access/
+  - /ee/ucp/user/access-ucp/cli-based-access/
 ---
 {% if include.version=="ucp-3.0" %}
 
diff --git a/ee/ucp/user/access-ucp/index.md b/ee/ucp/user-access/index.md
similarity index 93%
rename from ee/ucp/user/access-ucp/index.md
rename to ee/ucp/user-access/index.md
index be68dfd9d1..7da1ca1512 100644
--- a/ee/ucp/user/access-ucp/index.md
+++ b/ee/ucp/user-access/index.md
@@ -9,7 +9,9 @@ next_steps:
 - path: ../../authorization/
   title: Authorization
 - path: cli-based-access/
-  title: Access UCP from the CLI  
+  title: Access UCP from the CLI
+redirect_from:
+  - /ee/ucp/user/access-ucp/
 ---
 {% if include.version=="ucp-3.0" %}
 
diff --git a/ee/ucp/user/services/deploy-a-service.md b/ee/ucp/user/services/deploy-a-service.md
index d4803a1f4a..d676e79608 100644
--- a/ee/ucp/user/services/deploy-a-service.md
+++ b/ee/ucp/user/services/deploy-a-service.md
@@ -22,26 +22,26 @@ NGINX service.
 
 Fill in the following fields:
 
-| Field         | Value |
-|:--------------|:------|
-| Service name  | nginx |
-| Image name    | nginx:latest |
+| Field        | Value        |
+|:-------------|:-------------|
+| Service name | nginx        |
+| Image name   | nginx:latest |
 
 ![](../../images/deploy-a-service-1.png){: .with-border}
 
 In the left pane, click **Network**. In the **Ports** section,
 click **Publish Port** and fill in the following fields:
 
-| Field         | Value |
-|:--------------|:------|
-| Internal port | 80    |
-| Protocol      | tcp   |
+| Field         | Value   |
+|:--------------|:--------|
+| Internal port | 80      |
+| Protocol      | tcp     |
 | Publish mode  | Ingress |
-| Public port   | 8000  | 
+| Public port   | 8000    |
 
 ![](../../images/deploy-a-service-2.png){: .with-border}
 
-Click **Confirm** to map the ports for the NGINX service. 
+Click **Confirm** to map the ports for the NGINX service.
 
 Once you've specified the service image and ports, click **Create** to
 deploy the service into the UCP cluster.
@@ -59,7 +59,7 @@ page, by going to `http://<node-ip>:8000`.
 {% if include.version=="docker-cli-linux" %}
 
 You can also deploy the same service from the CLI. Once you've set up your
-[UCP client bundle](../access-ucp/cli-based-access.md), run:
+[UCP client bundle](../user-access/cli.md), run:
 
 ```bash
 docker service create --name nginx \
@@ -69,4 +69,4 @@ docker service create --name nginx \
 ```
 
 {% endif %}
-{% endif %}
\ No newline at end of file
+{% endif %}
diff --git a/ee/ucp/user/services/deploy-app-cli.md b/ee/ucp/user/services/deploy-app-cli.md
index b6164f4255..b9ccf35360 100644
--- a/ee/ucp/user/services/deploy-app-cli.md
+++ b/ee/ucp/user/services/deploy-app-cli.md
@@ -18,8 +18,8 @@ Docker UCP secures your Docker cluster with
 [role-based access control](../../authorization/index.md),
 so that only authorized users can deploy applications. To be able to run Docker
 commands on a cluster managed by UCP, you need to configure your Docker CLI
-client to authenticate to UCP using client certificates. 
-[Learn how to set your CLI to use client certificates](../access-ucp/cli-based-access.md).
+client to authenticate to UCP using client certificates.
+[Learn how to set your CLI to use client certificates](../user-access/cli.md).
 
 ## Deploy the voting application
 
diff --git a/ee/ucp/user/services/deploy-kubernetes-workload.md b/ee/ucp/user/services/deploy-kubernetes-workload.md
index f6eeb73f1b..4bed06a7b9 100644
--- a/ee/ucp/user/services/deploy-kubernetes-workload.md
+++ b/ee/ucp/user/services/deploy-kubernetes-workload.md
@@ -160,7 +160,7 @@ With Docker EE, you deploy your Kubernetes objects on the command line by using
 
 Use a client bundle to configure your client tools, like Docker CLI and `kubectl`
 to communicate with UCP instead of the local deployments you might have running.
-[Get your client bundle by using the Docker EE web UI or the command line](../access-ucp/cli-based-access.md).
+[Get your client bundle by using the Docker EE web UI or the command line](../user-access/cli.md).
 
 When you have the client bundle set up, you can deploy a Kubernetes object
 from YAML.