Everyone at your MSP gets their own login. Shared logins make the audit log useless, so each person should sign in as themselves.
Roles
| Role | Can do |
|---|---|
| Owner | Everything: billing, team, settings, the audit log, plus everything a tech can do |
| Tech | Add, rename, archive and restore clients; work the queue |
| Viewer | See clients and the team; change nothing. Billing, invites and the audit log are owner-only |
A workspace always keeps at least one owner. To step down as the only owner, make someone else an owner first.
Limit a tech or viewer to selected clients
By default everyone sees every client. Owners can limit a tech or viewer to the clients they work on, for example a dedicated engineer for a few accounts or an outside contractor.
- On Team, open Choose clients under the person.
- Pick Only the clients I choose, tick their clients, and select Save client access.
You can also do this when you invite someone, so they are limited from their first sign-in.
Someone limited to selected clients:
- Sees only those clients everywhere: the client list, the queue, offboarding, dashboard totals, waste by tool, reports, share links and their weekly digest.
- Can still do what their role allows on those clients (a tech can work the queue, offboard people, connect Microsoft 365 and share reports).
- Cannot do things that affect every client: add or import clients, link a tool's customers to clients, change the price book, or open the Portfolio Rollup.
- Still sees the team list.
The database enforces this, not only the app, so a limited person cannot reach other clients' data by any route. Owners always see every client; to limit an owner, change their role first. If you tick no clients, the person sees none until you add some.
New clients are not added to anyone's list automatically. When you add a client, add it to the people who should see it.
Every change is recorded in the audit log with the client names, and owners get a security alert.
Invite someone
- Go to Team and enter their work email.
- Pick a role and select Create invite.
- Copy the link and send it to them.
The link works once, only for that email address, and expires after 7 days. It is shown only when you create it. To resend, create a new invite for the same email; the earlier link stops working.
When they open the link, they sign in or create an account with the invited email and select Accept invite.
Change a role or remove someone
On Team, owners can change anyone's role or remove them. Anyone can leave a team themselves with Leave team. Every change is recorded in the audit log.
One workspace per login
Each login belongs to one MSP workspace. If someone already uses SeatReaper elsewhere, they leave that team first or accept your invite with a different email.