Skip to main content
Use Settings > Users & Roles to invite MSP staff, change their access, compare permission roles and manage team roles. This page is for MSP staff. Company users ask their IT provider to change their access.

Before you start

  • The tabs you see depend on your permissions. You need read access to Users, Roles or Company Users settings for the matching tab to appear.
  • Inviting, editing and bulk-changing users needs write access to Users settings. Deleting users needs manage access.
  • Create the role a person will hold before you invite them. Every staff user needs a role.
  • Company administrators cannot manage users themselves. A Company role does not grant access to MSP settings.

Choose a tab

Company roles are permission sets. Team Roles describe staff responsibilities and supply the Assignee Role choices for MSP-owned tasks in onboarding templates. Onboarding contacts, client-owned task assignees and email recipients use Settings > Projects > Onboarding Portals > Client roles instead.

Invite an MSP staff user

1

Open Settings > Users & Roles > Users

The table lists each staff user with their role, integration, status, calendar sync setting and last login.
Users tab listing staff with Role, Status and Last login, with Import and Invite User buttons
2

Click Invite User

The Invite User dialog opens.
3

Enter the person's details

Fill in Email and Full Name. Phone Number (optional) is optional.
4

Select a Role

Choose a tenant role. If the list is empty, create a role first on the Roles tab.
5

Choose how they sign in

Leave SSO user unticked to email an invitation. Tick SSO user (user will sign in with Microsoft 365 or Google) to create the account directly. For SSO users, you can also tick Send welcome email with login instructions.
6

Fill in any custom fields

Complete the required custom fields at the bottom of the dialog, if your organization has them.
7

Click Send Invitation

For an SSO user, the button reads Create User. A toast confirms the invitation.
To bring staff in from a connected tool, click Import, choose Import from your integration, and select the users to link or create.
In the import dialog, search through the column filters, or open Filters on a phone. Filter counts and Clear Filters sit in the import toolbar. See Import Users.

Edit a staff user

1

Open Settings > Users & Roles > Users

Find the person in the table.
2

Open the row menu and choose Edit

The Edit User dialog opens.
3

Change the details

You can change Full Name, Email Address, Phone Number (optional), Avatar URL, Role and Account Status (Active, Disabled, Pending or Imported). You cannot change your own role or status.
4

Click Save Changes

A toast confirms the update. Role changes apply the next time the user signs in.
The row menu also offers Change Role, Disable User or Enable User, Send Invitation (for pending and imported users) and Delete.

Change many staff users at once

1

Tick the checkbox on each user

The header checkbox selects the current page. You can also select every user that matches your filters.
2

Open Actions

The Actions (N) menu appears once you select a user.
3

Choose an action

Options include Change Role, Enable Selected, Disable Selected, Send Invitation Email and Delete Selected. Add teams and companies appears if you also have write access to Company Users settings. Enable Calendar Sync and Disable Calendar Sync appear when calendar sync is set to individual approval.
4

Review the confirmation

The dialog lists the users it will change. Confirm to apply. If an error reports partial completion, check the affected users before you retry.
Disabling a user signs them out. Deleting a user removes their sign-in account and cannot be undone. You cannot delete or disable your own account.

What deleting a user keeps

Deleting a user keeps the records they worked on, such as broadcasts they sent, meeting notes, planner templates and issued training certificates. Those records stay, without a link to the deleted account. MSPortal refuses to delete a user while scheduling still depends on them: client meeting bookings, meetings published to their Microsoft 365 calendar, or an Outlook recurring meeting that a company’s meeting schedule is linked to. The message names the reason. Disable the user instead to remove their access and keep that history. When you delete several users at once, the result names each person it could not delete and why, and the others are deleted. On Company Users, Remove Access deletes a Company user’s portal account and sign-in and blocks them from being imported again. The same rules apply: when you remove access for many users, the message names each user it skipped and why, and everyone else is removed.

Give staff access to specific companies

When Restrict users to assigned companies only is on in Tenant settings, staff see only the companies they are assigned to.
1

Open Settings > Users & Roles > Users

Tick the staff users to assign.
2

Choose Actions > Add teams and companies

Pick the Team roles and the Companies. Existing assignments are kept and duplicates are skipped. A batch can include up to 10,000 users, 100 companies and 50 team roles.
3

Click Add assignments

A toast reports how many assignments were added.
To give one person a role at every company and keep company-specific exceptions, see Global Team Roles.

Create a role

Open Settings > Users & Roles > Roles and click Add Role. The role guide walks through each field, permission level, the calendar visibility options and presets. When you open an existing role, the editor shows Loading permissions… until the role’s permissions load, and saving waits until they do. If they cannot load, click Try again. Saving a role you did not change shows No changes to save.

Duplicating a Role

Duplicate a role when an existing one is close to what you need.
1

Open Settings > Users & Roles > Roles

On the Role List sub-tab, find the role to copy.
Roles list with a row menu on each role and the Add Role button
2

Open the row menu and choose Duplicate

A new role named Copy of and the original name is created immediately.
3

Edit the copy

Click the new role to rename it and adjust its permissions, then click Update Role.
The copy keeps the description, permissions, role options such as bypass company restrictions and update emails, and, for Company roles, the ticket display group. It does not copy user assignments, so nobody holds the new role until you assign it. You need manage access to the role type to see Duplicate.

Compare roles side by side

The Permission Matrix puts the roles you pick side by side, so you can see what each one can reach without opening them one at a time. Each row is a permission and each column is a role. The column header shows how many active users hold the role.
1

Open Settings > Users & Roles > Roles

Select the Permission Matrix sub-tab. The first time you open it, the matrix shows your default role and the roles the most people hold.
Permission Matrix sub-tab of the Roles tab, with the Roles picker in the toolbar, a row per permission and a column per picked role, each cell showing None, Read, Write, or Manage
2

Pick the roles to compare

Open Roles in the toolbar, tick up to 8 roles, and click Apply. The list shows each role’s active users and marks the default role. The matrix remembers your pick the next time you open it.
Roles picker open over the Permission Matrix, listing roles with their active user counts, the default role marked, and the note Choose up to 8 beside Apply
3

Choose Tenant roles or Company roles

The matrix shows one role type at a time, and keeps a separate pick for each.
4

Read each cell

Manage includes Write and Read, and Write includes Read.
5

Expand a permission

Click the arrow beside a permission such as Projects & Client Onboarding to see its detailed options, like which project views a role can open. That one permission covers projects and client onboarding; see Client onboarding permissions. A Custom tag means the detailed options differ from the defaults for that level.
6

Filter the matrix

Use the column filters to narrow it. For example, filter a role’s column to Manage to list everything it fully controls, or filter Section to Settings.

Change access from the matrix

You can edit if you have write access to roles for Tenant roles, or write access to Company users for Company roles. Otherwise the matrix is read-only.
1

Change a cell

Change the level in a cell, or tick a detailed option in an expanded row. Edited cells are outlined.
2

Edit other roles if needed

Nothing is saved yet. You can pick other roles in Roles and keep editing; edits to roles you take out of the matrix are kept, and the toolbar counts them as not shown.
Permission Matrix with one edited cell outlined and the toolbar showing Unsaved changes to 1 role, Discard, and Save changes
3

Click Save changes

This saves every edited role, including roles not shown in the matrix. Click Discard to drop all edits.
Saving a role changes access for every user who holds it. Options that Manage grants stay locked until you lower the level. To rename a role, set it as the default, or change Company role settings such as quote visibility, use the Role List sub-tab.

Manage Team Roles

Team Roles describe responsibilities such as service manager or onboarding lead. They do not grant permissions. Read access to Company Users or Companies settings opens the tab. Write access to either lets you add and edit roles. Manage access to either lets you delete them.
1

Open Settings > Users & Roles > Team Roles

The tab lists your role definitions.
Team Roles settings showing role definitions and edit controls
2

Add or edit a role

Click Add Role to create a role, or click the edit icon on a row (or double-click a cell) to edit it in place. Click the check mark or press Enter to save, and the cross or Escape to cancel.
3

Fix any save error

If a role cannot be saved, one message explains why. Correct the form, or ask your MSP administrator to check your access, then save again.
Team Role edit form with one message asking the user to fix validation errors
Global staff assignments, PSA mappings and the client teams menu still need the matching Company Users settings permissions. If an onboarding template offers only one MSP role in Assignee Role, add and save the missing roles in Team Roles, then reopen the template.

Change a user’s access

Changing one user’s role and editing the role itself have different effects. A role edit changes the shared definition for everyone who holds it. Create a separate role when only some users need different access.

Find inactive Company users

Settings > Users & Roles > Company Users has a Last Login column showing when each Company user last signed in to the portal. Never means the user has not signed in. Hover over a date to see the exact time.
  1. Use the company selector to choose which companies to review.
  2. Sort Last Login ascending to list the longest-inactive users first. Users who have never signed in appear at the end in either direction.
  3. To list only users who have never signed in, filter Last Login to Not Set. To find recent sign-ins, choose a period such as Last 30 Days.
  4. Select a user to open their details. Last Login also appears there.
Use Columns to hide Last Login if you do not need it. Opening a user’s details hides it from the table, along with the other columns the details panel repeats.

Review and merge duplicate Company users

MSP staff whose role permits writing and managing Company users can open Settings > Users & Roles > Company Users and select Merge duplicates.
  1. Use the company selector to choose which companies to review.
  2. Open Merge duplicates. Each pair belongs to the same company and shows the names, email addresses, and the reason it matched. A matching name or email start is a suggestion; confirm that both records represent the same person.
  3. Use Previous and Next to review additional pages. Changing the company selection starts the review again on page 1.
  4. Choose Keep left to retain the record on the left, or Keep right to retain the record on the right.
Selecting Keep left or Keep right immediately merges the pair. Related contacts, tickets, and history are reassigned to the retained record, and the other portal user record is permanently removed. Conflicting duplicate records may be discarded. Review both records before choosing; this action has no Undo.
After a successful merge, the candidate list updates. No duplicate users found means there are no remaining matches in the current company scope. If loading fails, select Retry.
Duplicate user candidates with Keep left, Keep right, Previous and Next controls

Duplicate review on desktop, using sample contacts.

Duplicate user candidates and pagination on a phone

Duplicate review on a phone, using sample contacts.

Set access rules

Access rules act on the people MSPortal syncs from Microsoft 365 and your PSA, whether or not they have a portal user yet. Each rule has an Action: The Access Rules tab follows your role’s Users settings permission: read to see the rules, write to create and edit them, manage to delete them. Creating or editing an import rule also needs write access to Company Users settings. Without it, the dialog shows Importing users also needs permission to manage company users.
Access rules list with a Block sign-in rule and an Import Microsoft 365 users rule shown as Client user, each with Status, Match conditions, Matching Users, an on/off switch, edit and delete

Sample data: one rule of each action. An import rule shows its role under the action.

Access rules on a phone, each rule as a card with Action, Status, Match conditions, Matching Users and Last applied

The same rules on a phone.

Create an access rule

1

Open Settings > Users & Roles > Access Rules

Click Add Rule. When the list is empty, click Create first rule. The Create access rule dialog opens.
2

Name the rule

Enter a Rule name and, optionally, a Description.
3

Choose the Action

Choose Block sign-in or Import Microsoft 365 users. Switching to an import rule removes conditions that use PSA fields and starts you with Microsoft 365 license is assigned.
4

Choose the role (import rules only)

Role for imported users lists your Company roles, and the first one is preselected. Pick the role with the least access these people need.
5

Add the conditions

Choose Match all conditions or Match any condition, then click Add condition for each one. Every condition has a Field, an Operator and a Value. Import rules can use Microsoft 365 fields only: Microsoft 365 license, Microsoft 365 group, Microsoft 365 user type, Source account enabled, Display name, Email address, Job title, Department, Office location, Microsoft 365 employee type and Microsoft 365 employee ID. Block sign-in rules can also use PSA fields.
6

Preview the matches

Click Preview matches to list up to 100 synced identities that match. For an import rule, the summary shows how many users will be imported out of all matches, and each person shows the outcome described in Who an import rule skips.
7

Save and apply

Leave Apply this rule on and click Save and apply. A paused rule is saved but has no effect. Saving an import rule shows Access rule saved. Matching Microsoft 365 users are being imported.
Create access rule dialog with the condition Microsoft 365 license is assigned Microsoft 365 E3 in 2 companies, the Rule outcome, and a preview of 2 users to import of 4 matches marked Will be imported, Already a portal user and Imports off for this tenant

Sample data: an import rule for one license, with the preview showing who will be imported and why others are skipped.

Create access rule dialog on a phone with each previewed user as a card showing the company and outcome, above Save and apply and Cancel

The import preview and Save and apply on a phone.

Match by Microsoft 365 license

Use the Microsoft 365 license field with is assigned or is not assigned. The Value list shows the licenses synced from your clients’ Microsoft 365 tenants, with how many companies have each one. A rule matches that license in every client tenant, so one rule covers all of them. The condition works on both actions, for example to import everyone with Microsoft 365 Business Premium, or to block sign-in for accounts that have no license.

What an import rule does

  • When it runs: after each Microsoft 365 users sync, and right after you save the rule or turn a tenant’s user import back on.
  • Who it creates: a Company user in the company the person’s Microsoft 365 tenant is connected to, with status Imported and the rule’s role.
  • No invitation: MSPortal sends no email. The Microsoft 365 account is linked to the portal user when the person first signs in. To invite people, use Send Welcome Email on Company Users.
  • Existing users stay as they are: an import rule never changes a portal user, including their role. An address already used by a portal user in your organization, as a main address or a Microsoft alias, is skipped.
  • Turning it off keeps users: pausing, editing or deleting an import rule stops new imports only. Users it already imported stay. Remove them from Company Users if they should not have access.
  • Per tenant: to stop imports for one client’s Microsoft tenant, turn off user import on the Microsoft 365 Companies page.
Avoid overlapping import rules with different roles. Each person is imported once, so give each group of people one rule.

Who an import rule skips

Pause, edit or delete a rule

Use the switch on a rule’s row to pause or resume it. It saves right away. The pencil opens the rule for editing, and the trash icon deletes it after you confirm. Deleting a Block sign-in rule restores sign-in for users that only this rule denied. Deleting an import rule keeps the users it imported.

Troubleshooting

Frequently asked questions

Company Users. Users contains MSP staff accounts.
In Roles > Company Roles. To assign an existing group to a particular user, edit the user’s Permissions Group in Company Users.
No. The MSP manages Company users and permissions. The role name describes a Company permission set, not MSP administrator status.
No. The Primary Admin flag is separate from the role’s name and permissions. Only the Primary Admin can change it, in Edit User.
No. Team Roles describe responsibilities and grant no permissions. Use Tenant or Company roles to define portal access.
No. Invitations, role assignments, role definitions and account removal are separate actions. A role change does not send an invitation or create missing company data.
No. The copy has no users until you assign it.
MSPortal disables a Company user when the connected systems show they have left:
  • Microsoft 365: every Microsoft 365 account linked to the user has sign-in blocked. This applies even if their PSA contact is still active.
  • PSA: their contact is marked inactive in ConnectWise, Autotask, or Halo PSA, and they have no other active contact.
A disabled user loses portal access and is signed out. They no longer appear in user dropdowns such as a ticket form’s employee field. Company Users hides them unless you filter Status to Disabled. If sign-in is unblocked in Microsoft 365, the next sync restores a user disabled by the Microsoft 365 rule.
No. Imported users get no email. Each person’s Microsoft 365 account is linked when they first sign in. Send invitations from Company Users when you are ready.
They stay. Deleting or pausing a rule, or turning user import off for a tenant, only stops new imports.