-
-
Notifications
You must be signed in to change notification settings - Fork 0
MSP and Client Orgs
With an MSP license, IdPVault becomes multi-client. A client org groups the tenants you run for one customer and carries light CRM fields: contact name/email/phone, free-form notes, a billing memo (what you charge them, in your own words), billing cadence, and the next renewal date. None of this touches backups - it exists so the person running the MSP has the client picture in the same pane of glass.
- Install an MSP license (Settings > License). The Orgs page appears in the nav for admins.
- Create an org per client on the Orgs page.
- Assign tenants to orgs: edit a tenant and pick the org in the Client org dropdown. Tenants with no org are internal.
- Give the client access if you want to: create users with role org_admin or org_viewer and pick their org. Each org-scoped user belongs to exactly one org.
org_admin: sees only their org's tenants; can run backups, browse snapshots and diffs, and apply config and Users & Access restores on those tenants. Cannot create or edit tenants, users, orgs, schedules, or settings. org_viewer: same visibility, strictly read-only - disabled action buttons carry a "contact your MSP administrator" hint.
Scoping is enforced server-side. A tenant outside the user's org returns 404 (not 403), so org users cannot discover what other clients exist. The dashboard, events feed, and recent runs are filtered the same way.
The Orgs page has three CSV buttons. Export CSV downloads every org with all fields - useful as a backup or for editing in a spreadsheet. Template downloads an empty CSV with the correct columns and one example row. Import CSV bulk-creates orgs from a file: each row is validated like the form (name required, cadence monthly/annual/empty, renewal date YYYY-MM-DD), rows whose name already exists are skipped and never overwritten, and the result message tells you how many were imported, skipped, or had errors. Onboarding 40 clients is one upload instead of 40 forms.
When any org has a renewal date within the next 60 days (or already past), admins see a Client renewals panel on the dashboard listing the org, the date (overdue dates are flagged), and the billing memo.
Deleting an org never deletes data: its tenants and users are kept and simply unassigned. Org-scoped users left without an org see no tenants until you reassign them.