Operating
Roles & permissions
A user is assigned a role per tenant. From highest to lowest:
| Role | Scope | Can do |
|---|---|---|
| Platform Admin | All tenants | Everything, across every customer. Creates MSP accounts, sets billing entitlements, sees Usage & Billing. |
| MSP Admin | Their MSP + customers | Manages the MSP and all customer tenants: content, task sequences, boot media, drivers, settings, and customer accounts. |
| MSP Technician | Their MSP + customers | Day-to-day delivery (task sequences, content, boot media, drivers, deployments) - but not account admin (can't create customers or change content scopes). |
| Customer Admin | Their own tenant | Self-service admin via My Organisation: users, sites, branding, and Intune / Autopilot config. |
| Operator | Their tenant | Hands-on deployments: build task sequences, manage content / boot media, run deployments. No admin, drivers, reports, or audit. |
| Viewer | Their tenant | Read-only: Dashboard, Deployments, and Reports. |