MSP accounts

An MSP account is a workspace of type msp. It runs no product of its own: there are no datasets, no scans, no firewall apps that belong to the account itself. What it holds is a licence stating how many client workspaces it may create and a pool of seats it shares out among them, and the tools to create, license, and work inside those clients. Every client is an ordinary organization workspace with its own people, its own roles, and its own data. Nobody from the account becomes a member of a client. Instead, an account member opens a client for a limited window, works inside it as a fixed, restricted role, and leaves.

​

How this differs from an organization workspace

The account’s own menu is:

• Portfolio: Overview (what needs a person today, across every client) and Clients (every client, its protection, licence and your access).
• Operations: Billing (the seat pool, what each client used by month, and what renews when), Activity (every opening of a client and every refusal), Team (this account’s own people, roles, keys and directory), Client access (which clients each of your people can open), and Settings.

A member who holds only the billing role sees Billing and nothing else. See Team & permissions.

​

What clients see

Nothing changes for a client’s own people day to day. The one visible difference is the Your MSP setting. The operator working inside the workspace sees a band naming the account, the time left and a way to leave; the client’s own people do not. Sessions show in the client’s audit trail. See Opening a client.

​

The security model, in one list

• An operator opens a client for a limited window at a time, never by becoming a member of it.
• Opening needs a fresh two-factor code from the operator’s own authenticator app, unless the client has switched that requirement off for itself.
• Everything an operator changes inside a client is recorded in the client’s own audit trail before the change runs. A change that cannot be recorded is refused rather than made silently.
• Operators can never, from inside a client: invite, create, edit or remove people, assign roles, reset anyone’s password or two-factor, create API keys, configure directory or SSO, change the security policy, decide whether the MSP itself may have access, or mint a credential that would outlive the session. They also cannot change their own account while a client is open. That lives with the MSP account, and is reached by leaving first.
• The client’s own admins decide, at any time, whether their MSP may open the workspace at all. Turning it off ends every session already open, immediately.
• Either side can end the relationship. The client ends the link from its own Your MSP setting, and the account releases a client from Clients. Each needs a fresh proof, and neither deletes anything in the client. See For clients and Clients.

​

Next