Skip to main content

Delegated sessions

Your staff are never members of a client organization. To work inside a client, an operator opens a delegated session: a window of at most a few hours, scoped to one client, with a stated reason, ending on its own. The platform checks the session, not a membership, on every read and write the operator makes, so when the session ends the access is gone with it.

Starting one​

Three ways in, all leading to the same dialog:

  • Act as Client on a client's page.
  • Jump to a client in the top bar, then any client under Recent or All Clients.
  • A client listed under Active Sessions in that same menu, which skips the dialog and takes you straight in, since a session is already open.

The Act as Client dialog asks for:

  • Reason: routine service delivery, evidence review, compliance assessment, incident response, client onboarding or setup, QBR preparation, report generation, client-requested support, billing review, client offboarding, or other.
  • Details: at least ten characters of your own words. The button stays off until you have written them.
  • Duration: 15 or 30 minutes, or 1, 2, 4 or 8 hours. The default is 1 hour. There is no portal setting for a lower maximum.
  • Access Level: Full Access or Read Only. Read only wins over whatever your role would allow.

Start Session opens the client with a DELEGATED SESSION banner.

The dialog says the session is logged and that the client's own administrators can review that log. It also mentions recording your IP address. The IP address is not currently recorded. See The record for what is written today.

What decides what you can do inside​

Your role and your team assignment are applied together at the moment the session starts:

  1. Your role at the partner sets the ceiling. Administrators can read, create, update and delete; compliance managers, vCISOs, analysts and most other roles can read, create and update; auditors and read-only executives can read.
  2. Team assignment. Everyone except the two administrator roles must be assigned to the client through a team, or the session is refused with that reason. A team assigned at a read-only or advisory level caps the session at read. The portal cannot create such an assignment; team assignments made in the portal are always full access.
  3. Module access set for your team on this client is recorded but is not enforced.

Other refusals you can meet: the organization is not managed by your partner, it has been archived, or you already have a live session there (use it from Active Sessions instead).

Inside the client​

You land in the client's normal workspace. A banner across the top reads DELEGATED SESSION with the reason and a countdown; it turns red in the last five minutes. The organization switcher shows "via MSP Session" under the client's name instead of a role. The session is also counted on the partner dashboard's active sessions figure and listed under Active Sessions in the client menu, with its minutes remaining, for as long as it runs.

Ending​

  • End Session in the banner asks for an optional note ("Work completed, review finished") and returns you to the client list.
  • When the countdown reaches zero the session expires and you are returned to the client list. Nothing you did is lost; you have simply left.
  • A partner administrator can revoke a live session from Sessions, with a reason. Access ends immediately. The operator's banner disappears within about 30 seconds.

The record​

Sessions lists the most recent sessions across the partner: operator, client, reason, scope, status (active, ended, expired, revoked), start time and duration. Search by operator, client or the reason text. Administrators revoke from here.

Audit Trail (under Settings) opens the Operator Audit Trail page, which is for administrators only. It lists the 100 most recent operator actions across your clients, with the action and the object it touched. Filter by action name. Actions are not yet tagged with the session they were taken in, so the Via column and the Delegated sessions only filter show nothing session-specific.

Session start, end and revocation are written to the client's own audit log, where the client's administrators can read them.