MSP Control Center · Delegated access

Technicians see only what their role allows

Proposed interface concept Not released. A design for discussion, drawn in HTML and CSS; not a screenshot of working software.

Permission profiles for an MSP team, from first-line technician to owner and the customer’s own administrator, with each permission scoped to tenants and some actions requiring approval. Access to customer data is denied by default and logged. The roles shown are examples, not a final authorization model.

View full size Download image (WebP, 1600×948) For managed service providers

Proposed interface concept Not released · example data · subject to change

Office UnboundMSP Control CenterSearch customers, users and tenants/3MC

CustomersProvision4AlertsUpdatesAccessReportsSettings

Ridgeline ITAccess Delegated accessExample data

Access log New profile

ProfilesPeople 21Approvals 2Access log

Example roles — not a final authorization model. Shown to illustrate scoped, approval-based access. Anything not granted is denied by default.

Permission profiles AllowedNeeds approval fromDenied by default

Profile	Tenant scope	Reset passwords and MFA	Manage mailboxes	Change security policies	Approve updates	View billing	Read customer data
Level 1 Technician4 people · Assigned customers	Assigned customers	Reset passwords and MFAAllowed	Manage mailboxesAllowed	Change security policiesDenied	Approve updatesDenied	View billingDenied	Read customer dataDenied
Level 2 Technician3 people · Assigned customers	Assigned customers	Reset passwords and MFAAllowed	Manage mailboxesAllowed	Change security policiesNeeds Manager	Approve updatesAllowed	View billingDenied	Read customer dataDenied
Level 3 / Senior Engineer2 people · All customers	All customers	Reset passwords and MFAAllowed	Manage mailboxesAllowed	Change security policiesNeeds Manager	Approve updatesAllowed	View billingDenied	Read customer dataNeeds Customer
Sales2 people · All customers · summary only	All customers · summary only	Reset passwords and MFADenied	Manage mailboxesDenied	Change security policiesDenied	Approve updatesDenied	View billingAllowed	Read customer dataDenied
Manager1 person · All customers	All customers	Reset passwords and MFAAllowed	Manage mailboxesAllowed	Change security policiesAllowed	Approve updatesAllowed	View billingAllowed	Read customer dataNeeds Customer
Owner1 person · All customers	All customers	Reset passwords and MFAAllowed	Manage mailboxesAllowed	Change security policiesAllowed	Approve updatesAllowed	View billingAllowed	Read customer dataNeeds Customer
Customer Administrator8 customer admins · Own organization only	Own organization only	Reset passwords and MFAAllowed	Manage mailboxesAllowed	Change security policiesAllowed	Approve updatesAllowed	View billingAllowed	Read customer dataDenied

Approval rulesEdit

PolicyLevel 3 change to a security policy requires Manager approvalAlso Level 2 · change applies only after approval
DataCustomer data access requires customer approval and is loggedTime-limited, one mailbox or folder at a time · customer sees the log
UpdatesApproving the Broad ring requires Level 2 or above
TenantDeleting a tenant requires the Owner and the customerExport offered first · 30-day hold

Waiting for approval2

SI Sam Ito · Level 3 · change MFA policyPinecrest Property Mgmt · “Allow SMS codes for warehouse staff” · waiting for a Manager ApproveDeny
DR Dan Reyes · Level 3 · read one mailboxKestrel Logistics · j.marsh, for 4 hours, to trace a lost invoice · waiting for the customer’s admin Sent to customer

Every grant, approval and data access is written to the customer’s audit log.

Customers4AlertsUpdatesAccessMore

Technician access scoped by role and customer, with approvals where a change or data access needs a second person.

Shape this before it is built

This screen is a proposal. MSP design partners review concepts like this one against how they actually run customers, and say what is missing.

Become an MSP design partner Register interest