Who can do what in your portal, your private vault and your security page
See who has access to your company's portal and exactly what each role can do, keep your team's own passwords and documents in a private vault your IT provider does not see, and, if you are the owner, Primary Contact or IT Admin, read your security picture and the threats handled for you.
Access legend
A tip explains that each person's access follows their role, and three badges define the tiers: View means read-only, Edit means create and modify, and Admin means full control.
Search
Search users looks up anyone on this list by name or email.
A person's row
Each person shows their name and email. The owner carries an Owner badge and Full Access on the right. Everyone else shows their role's name there, with how many sections that role reaches out of the total, and badges counting the sections at each tier.
Access by section
Opening a row expands a breakdown of what that role reaches in each part of the portal. Each part reads View, Edit, Admin or No access, and the owner reads Admin on every part except My Vault, which reads Personal.
Browse
On this page
Why it works this way: Who can do what in your portal, your private vault and your security page
Each person has one role, and the role sets the access. There are no switches per section. To change what someone can do, change their role.
User works their own tickets and can read Documentation, My Vault and Security Training. Billing sees every invoice, can save the company's card, and can read devices, licenses, documentation and meetings, but cannot change settings or users.
IT Admin works tickets in full and can edit devices, licenses and documentation. Primary Contact can do almost all of it, including adding users and changing settings. The Owner always has full access, and the owner's role is locked.
To give someone access, you need the Primary Contact, IT Admin or Owner role. Find the person by name or email, open their row and pick a role. They must already have a Microsoft 365 or Google Workspace account at your company. A person who has not signed in yet shows Invited, pending, with Cancel invite on that row.
My Vault is your own private space, with Documents for your notes and how-tos and Passwords for logins your team keeps for itself. Your IT provider does not see it, not even when viewing the portal as your company.
Open an entry to say who sees it. Team visibility has a toggle, Visible to everyone in your organization, and Visible to specific users with Add User for naming teammates one at a time. Whoever makes an entry can always see it, and people with the User or Billing role see only what is shared with them. Each entry shows whether it is Private or Shared.
Share links hand an entry to someone outside the portal. Click New link, pick how long it works, add a cap on opens and a passphrase if you want, then copy the link, which shows only once. Opens are logged under your company and you can revoke a link any time.
Import brings in passwords you already have. On Passwords press Import, then use Download CSV template or choose a .csv or .json export from another vault. Your file is read in your browser, and you review every row before anything is saved.
Security is for the owner, Primary Contact and IT Admin. Most of them get two tabs. Overview is your picture right now: your Microsoft 365 secure score, sign-in checks, threats handled and things to improve, with Recent security activity showing the latest handled threats. History lists the threats handled for your company, resolved or expired, and each row opens that threat's own page. A brand new connection reads Monitoring hasn't started yet until the first data arrives, which is expected.
If your own team runs IT alongside your provider, Overview adds the full event list and your protection settings, and Response Rules replace History: the set responses that run for your company on their own.
Questions this page answers
How do I manage portal users?
Owners, the Primary Contact and IT Admins can open Users. The list shows who can sign in and what role each person holds. You can give someone access there, and you can change their role. Your IT provider can also set this from their side. A person who has not signed in yet shows "Invited, pending" with who invited them and when; "Cancel invite" on that row turns their account off.
What are the portal access roles?
Each person gets one role. A User sees only their own tickets. They can read most other pages. Billing can see every invoice. They can also read devices, licenses, docs, and meetings. They cannot change settings or users. An IT Admin works tickets in full. They can also edit devices, licenses, and docs. A Primary Contact can do almost all of it. That includes adding users and changing settings. The Owner has a badge by their name. The Owner always has full access.
How do I give someone portal access?
You need the Primary Contact, IT Admin or Owner role. Go to Users and find the person by name or email. They must already have a Microsoft 365 or Google Workspace account at your company. Open their row and pick a role. The role sets what they can reach. There are no separate switches per section.
How do per-section permissions work?
A role sets them. You do not set them one by one. Expand a row to see what that role gives for each part of the portal. Each part reads View, Edit, Admin or No access. To change what someone can do, change their role. The access then shifts to match. The Owner always has Admin on every part.
What is My Vault, and who can see it?
My Vault is your own private space. It has a Documents part for your notes and how-tos. It has a Passwords part for logins your team keeps for itself. Your IT provider never sees any of it. Not in their tools. Not even when they view the portal as your company. Only your own people can see it, and only what they were given.
How do I say who on my team sees an entry?
Open the entry. Owners, the Primary contact and IT Admins get a visibility panel. Turn on visible to everyone to let the whole company read it. Or leave it off and add teammates by name. Whoever makes an entry can always see it. People with the User or Billing role see only what is shared with them.
Can I bring in my passwords from another vault?
Yes. Open "Passwords" in My Vault and press "Import". There are two ways in. If you are typing the list yourself, press "Download CSV template", fill it in, then pick it. If you already have an export from another password vault, pick that file. Use "Choose a file" either way, for a .csv or a .json. Your file is read in your browser. It never leaves your computer. If we know the export, we say so, and the columns are matched for you. If not, "Match your columns" lets you set each one yourself. Next you see every row and what will happen to it. A row with no name, no password, or a bad web address is left out. So is a row you already have. Nothing is saved until you press the import button. Your IT provider never sees any of it.
What do the tabs on this page show?
What you see depends on your access. Most people get two tabs. Overview is your security picture right now. It holds your Microsoft 365 secure score, sign-in checks, threats handled this month, and things to improve. History lists every threat handled for your company, newest first. If your own team runs IT with us, Overview is fuller: it adds the whole event list and your protection settings. In place of History you get Response Rules. Those are the set responses that run for your company on their own.
Was this helpful?