> ## Documentation Index > Fetch the complete documentation index at: https://docs.blindsight.io/llms.txt > Use this file to discover all available pages before exploring further. # Opening a client > Opening a client workspace to work inside it: the code step, how long it lasts, the countdown band, and what happens when time runs out. Opening a client is the only way an account member works inside it. Nobody from the account is ever a member of a client workspace; instead `msp.clients.access` lets you open one for a limited window. ## Starting Open a client from either place: * **The top bar's "Open client"** control, anywhere in the account's console: a searchable list of every client, each with its protection dot. Clients whose access is off are greyed out and cannot be selected. * **Clients → Open**, on a client's row, when access is on. If your account limits you to some clients (see [Limiting an operator to some clients](https://docs.blindsight.io/msp/team-and-permissions.md#limiting-an-operator-to-some-clients)), only those appear. Any other client behaves as if it does not exist: it cannot be opened, and asking for it directly is answered as if it did not exist. The open dialog has an optional **Reason or ticket** field, up to 200 characters. It is kept with the session and shown in [Activity](#activity). ## The code step Opening needs two-factor authentication turned on for **your own** account; if it is not, you are sent to turn it on in your profile first. Beyond that: * If the client requires a code (its default), enter the current code from your authenticator app. Backup codes are not accepted for this: they exist to get back into your own account, not into a client's. A wrong code counts as a failed sign-in attempt on your account and locks it after too many. * If the client switched off "Ask for a two-factor code every time" for itself (see [For clients](https://docs.blindsight.io/msp/for-clients.md)), opening skips the code step: you open directly, on the strength of already being signed in to your own account. Opening another client closes whichever one you had open before it; only one is open at a time. ## How long it lasts Each client chooses how long one opening lasts: 15 minutes, 30 minutes (the default), 1 hour, 2 hours, 4 hours, or 8 hours. A change the client makes applies to the **next** opening only; it never shortens or lengthens a session already in progress. ## The band across the top While a client is open, a filled band runs across every page: whose workspace it is, which account you are in it as, and a live countdown. In the last five minutes the dot turns amber and the band says how to continue. When time runs out, the page you are on stays exactly as it is (nothing more is sent), and the band offers **Back to clients**. **Leave workspace**, in the band, ends the session immediately and returns you to the account. ## What ends a session early * The countdown reaching zero. * Choosing **Leave workspace**. * The client switching its own MSP access off, which ends every session open into it at once. * The client ending the link, or your account releasing the client, which ends every session open into it at once. * Losing the permission, having two-factor turned off, having your password changed or your sign-ins revoked, or leaving the MSP account: each is checked again on every request inside the client. ## What you can and cannot do inside See [Team & permissions](https://docs.blindsight.io/msp/team-and-permissions.md) for the full list. In short: the products and settings a client's own admin can reach, minus anything that would outlive the session or hand the MSP lasting access: inviting, editing or removing people, roles, API keys, directory and SSO, the security policy, anyone's password or two-factor, and the client's own decision about whether its MSP may open it at all. Every change you make inside a client is written to that client's own audit trail before it runs. ## Activity **Activity** (Operations → Activity, `/msp/activity`) is your account's own record of openings. It needs `msp.clients.view`, and a scoped member sees only the clients in their scope. It lists, newest first, every client your account has opened now or in the past, including clients since released, with these columns: **When**, **Operator**, **Client** and **What happened**. Three kinds of row appear, and the chips above the list filter between them. **All** shows every kind: | Filter | Shows | | - | - | | **Sessions** | An opening of a client. The row says whether it is still open or timed out without being ended, and counts the changes and refusals inside it. | | **Refused to open** | An attempt to open a client that was refused. | | **Refused actions** | A change attempted inside a client that was refused. | You can also narrow the list to one client or one person. A row opens only when it has a reason or a refused request, so a session opened without a reason shows no start or expiry detail. Open a row to read the rest: for a session, the reason or ticket entered when it was opened, when it started and expired, and when and why it ended; for a refusal, the reason given and the request that was refused. ## Next > **[Team & permissions](https://docs.blindsight.io/msp/team-and-permissions.md)** > > The MSP permissions, client scopes, and what an operator session can reach. > **[For clients](https://docs.blindsight.io/msp/for-clients.md)** > > The switches a client controls: access, the code, and how long an opening lasts. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.