diff --git a/config_tempest/config_tempest.py b/config_tempest/config_tempest.py
index 51a86e24..2e0bb6b4 100755
--- a/config_tempest/config_tempest.py
+++ b/config_tempest/config_tempest.py
@@ -520,32 +520,32 @@ class ClientManager(object):
         if "v2.0" in conf.get("identity", "uri"):
             self.identity = identity_client.IdentityClient(
                 _auth, conf.get_defaulted('identity', 'catalog_type'),
-                self.identity_region, endpoint_type='adminURL',
+                self.identity_region, endpoint_type='publicURL',
                 **default_params)
         else:
             self.identity = identity_v3_client.IdentityClient(
                 _auth, conf.get_defaulted('identity', 'catalog_type'),
-                self.identity_region, endpoint_type='adminURL',
+                self.identity_region, endpoint_type='publicURL',
                 **default_params)
 
         self.tenants = ProjectsClient(
             _auth,
             conf.get_defaulted('identity', 'catalog_type'),
             self.identity_region,
-            'adminURL',
+            'publicURL',
             self.identity_version,
             **default_params)
 
         self.set_roles_client(
             auth=_auth,
             conf=conf,
-            endpoint_type='adminURL',
+            endpoint_type='publicURL',
             default_params=default_params)
 
         self.set_users_client(
             auth=_auth,
             conf=conf,
-            endpoint_type='adminURL',
+            endpoint_type='publicURL',
             default_params=default_params)
 
         self.images = images_client.ImagesClient(
diff --git a/releasenotes/notes/default_endpoint_type-792092b7027768ae.yaml b/releasenotes/notes/default_endpoint_type-792092b7027768ae.yaml
new file mode 100644
index 00000000..37f828c5
--- /dev/null
+++ b/releasenotes/notes/default_endpoint_type-792092b7027768ae.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    We were using adminURL to talk to Keystone API but in most cases, we run Tempest
+    from outside of admin network for security reasons. We now use public URL, so the
+    public network, which is what we expect our cloud users to do.