> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/management/system-users-and-permissions.md). # System Users & Permissions System Users are the admin accounts for the Augmentt platform itself — the people at your MSP (and, if you choose, your customers) who log in to Augmentt to manage companies, run reports, and configure integrations. This page covers how System Users, permissions, and Collections work together to control who can see and do what. ## System Users Every System User is created with a combination of **permissions** and **company access**. ### Permission levels Most features can be set to one of three levels: * **Disabled** — the feature is hidden from the user entirely. * **Read-Only** — the user can see the feature but can't make edits. * **Manage** — the user can see the feature and perform edit-type actions. {% hint style="info" %} Some features only support **Disabled** or **Manage** — there's no read-only option for them, because Augmentt didn't see enough value in a view-only mode for those particular features. If you'd like a read-only mode added for a specific feature, that's worth raising as a feature request. {% endhint %} ### Login options You can also control **how** a System User is allowed to log in — for example, restricting them to SSO only, or allowing username/password. Choose the login options that fit your security requirements for that user. ### Company access To limit a System User to specific companies, select those companies in the **Company Selector** when creating or editing the user. {% hint style="warning" %} A System User with **All Companies** selected will automatically inherit any new company you add later. If you want a user's access to stay scoped to a fixed list, select those companies explicitly rather than using "All Companies." {% endhint %} This is the standard way to give a client or technician limited visibility — for example, giving a client direct, read-only access to only their own tenant, with Manage-type permissions disabled. ## Collections (Multi-CSP) **Collections** is a feature available to organizations with the Multi-CSP license. It lets a Parent Organization admin group customer companies into named Collections — typically one per MSP partner — and assign System Users to manage a specific Collection. ### Role hierarchy Collections introduce a four-tier access model: | Role | Access | | ----------------------------- | --------------------------------------------------------------------------------------------------------------------- | | **Parent Organization admin** | Top-level access to all companies and Collections. Can create and manage Collections. Requires the Multi-CSP license. | | **MSP admin** | A System User assigned to a Collection. Can only view and manage companies within that Collection. | | **Org admin** | Full access to all companies in a standard (non-Multi-CSP) environment. Cannot view Collections. | | **Regular user** | Directly assigned to specific companies. Not affected by Collections. | ### What is a Parent Organization? A Parent Organization is any top-level Augmentt organization that oversees multiple MSPs or groups of companies — for example, SOC providers and MSSPs managing partner MSPs, or MSPs that have grown through mergers, acquisitions, or CSP migrations and now need to manage distinct groups of companies separately under one Augmentt account. ### Creating a Collection Only Parent Organization admins can create Collections. 1. Navigate to **Companies** and select the **Collections** tab. 2. Click **Add Collection**. 3. Enter a name for the Collection — typically the MSP's name. 4. Select the companies to include. 5. Save. ### Managing companies in a Collection 1. From the **Collections** tab, select the Collection you want to manage. 2. Click **Add Company** and select the companies to include. 3. Save your changes. A company can belong to more than one Collection. When a Parent Organization admin creates a new company, they can optionally assign it to a Collection at creation time — from the Add Company modal, the Magic Link modal on the CSP page, or the Create and Map modal on the CSP page. ### Assigning a user to a Collection 1. Go to **Management > System Users**. 2. Create a new user, or edit an existing one. 3. Under **Select Companies**, choose **Select Collection**. 4. Select the Collection from the dropdown. 5. Complete the rest of the user setup and save. That user is now an MSP admin for that Collection and will only have visibility into companies within it. ### The MSP admin experience When logged in as an MSP admin, the Augmentt interface is scoped to the assigned Collection only: * Only companies within the Collection are visible. * User management is limited to users within the same Collection. * New companies created by an MSP admin are automatically assigned to their Collection. * MSP admins cannot view or modify Collections themselves — that remains a Parent Organization admin function. {% hint style="info" %} Collections are only available to organizations with the Multi-CSP license. Standard organizations aren't affected. Contact your account manager to request access. {% endhint %} Regular users with direct company assignments keep their existing access even in a Multi-CSP environment. ## Common issues & questions * **New System User can't log in / gets a 404 after entering credentials.** This can happen shortly after a user is created. Try a different browser or incognito window first; if it persists, contact support with the user's email and login method (password vs. SSO). * **Invitation email never arrives.** Check spam/junk first, and confirm the email address on the System User record. If a mail trace on your own tenant shows nothing arrived from `no-reply@augmentt.com`, support can investigate whether the invite was suppressed upstream — deleting and recreating the user is a common workaround while that's looked into. * **Changing the "Owner" role.** If you need to reassign the Owner role on a System User (for example, an employee is leaving, or you originally set the account up on someone else's behalf), this typically requires a support ticket rather than a self-service toggle. * **Company access unexpectedly reset to "All Companies."** If System Users that were scoped to a specific Collection or company list suddenly show access to everything, this is unexpected — report it to support with a screenshot of the affected users' current settings. * **Requests for more granular permissions.** We regularly hear requests for finer-grained control — for example, separating "who can create/edit policy templates" from "who can apply them," or reducing the number of Microsoft admin roles required for read-only style access (block sign-in, force MFA/password reset) without granting full administrative roles. These are active feedback themes; if your use case needs something the current Disabled/Read-Only/Manage model doesn't support, raise it with support or via the community feedback site so it's tracked as a feature request. {% hint style="warning" %} Exact permission names and the full list of what each permission level unlocks can change between releases. Check the current System User creation screen in your instance for the authoritative, up-to-date list of permissions. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://helpdesk.augmentt.com/management/system-users-and-permissions.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.