MSSP Console

Overview

Managed security service providers (MSSPs) can run their client tenants from a hosted Veltrix account. The model is deliberately small:

• An MSSP account is an ordinary organization that has been converted to an MSSP provider by one of its administrators.
• An MSSP owns one or more portfolios (tenant groups). A portfolio is a named set of client tenants.
• A client tenant joins a portfolio in one of two ways: the MSSP onboards a brand-new tenant into it, or an existing organization sends a join request that the MSSP approves.
• The MSSP's own staff are granted Viewer or Manager access to a portfolio. That access opens the Group Admin console for the portfolio's tenants.
• A client can leave at any time and keeps all of its data.

Client tenants stay isolated from each other, and an MSSP can only reach portfolios it owns. The console organizes and administers tenants; it does not let the MSSP author or deploy configuration inside a client tenant, push a baseline to many tenants at once, or send notifications. The What It Does Not Do section lists the boundaries. For the business case, see the MSSP use case.

Concepts

A platform operator can also create unowned tenant groups and grant users access to them. Such groups appear in Group Admin for the people granted, but they have no owning MSSP and do not appear in the MSSP console.

Become an MSSP

Any organization administrator can convert the account from the organization settings.

1. Open Settings → Organization. Scroll to the MSSP card at the bottom.
2. Select Convert to MSSP and confirm the dialog ("Convert to an MSSP account").
3. Veltrix marks your organization as an MSSP provider, creates your first portfolio named "<your organization> Portfolio", and grants a Manager role on it to you, the administrator who ran the conversion.
4. You are taken to the MSSP console at /mssp, and an MSSP entry appears in the sidebar under Govern.

• Requires the organization:write permission. Users without it do not see the card while the account is a regular tenant.
• Converting again is safe: it keeps the existing portfolio and re-ensures the Manager grant for the person converting.
• Once converted, the card reads "Your organization is an MSSP provider managing N portfolios" with an Open MSSP console button.
• An MSSP account does not see the "Managed by an MSSP" card; MSSP providers do not join other MSSPs. There is no self-service way to convert back.
• Impersonated sessions (a platform admin acting as a user) cannot use the MSSP console.

MSSP Console and Portfolios

Open MSSP in the sidebar (Govern group; route /mssp). The entry only appears for MSSP accounts. The page needs organization:write and an MSSP account.

Page layout

• Header actions: Open Group Admin (goes to /group-admin) and New Portfolio.
• Stat cards: Portfolios, Managed Tenants, and Staff Grants (totals across the portfolios you own).
• Join Requests section: appears only when requests are pending. See Join Requests.
• Portfolio table: Portfolio (name and description), Tenants, Staff, and Created, with row actions Onboard, Staff, and Delete.

Create a portfolio

1. Select New Portfolio.
2. Enter a Name (required, unique across the platform) and an optional Description.
3. Select Create portfolio. You, the creating admin, are granted Manager on it automatically.

A name that is already used returns an error ("A portfolio named ... already exists"). The API also supports renaming and re-describing a portfolio (PUT /api/mssp/portfolios/:id); the console does not expose that action yet.

Delete a portfolio

Select Delete on a row and confirm. The portfolio's tenants are ungrouped, not deleted: they remain active organizations, now unmanaged, and the portfolio's staff grants are removed with it.

Onboard a Client Tenant

To add a client that does not have a Veltrix tenant yet, create it from inside the portfolio.

1. On the portfolio's row, select Onboard ("Onboard a managed tenant").
2. Fill in Customer name (required), Domain (optional), Admin email (required), and optionally Admin password (at least 8 characters).
3. Select Onboard tenant. Veltrix provisions the tenant with its subscription, default roles, and the first admin user, then attaches it to the portfolio in one step.
4. If you left the password blank, a one-time temporary password is shown in a dialog with a Copy button. It is displayed only once; share it securely with the client's admin.

• The console does not ask for a plan, so the new tenant starts on the default (free) plan with that plan's limits. A portfolio manager can raise per-tenant quotas within caps (see Group Admin); changing the plan itself remains a platform-operator action.
• The admin email is the new tenant's first user. An email address can belong to only one user on the platform.

Staff Access

Staff grants decide which of your own people can open a portfolio in Group Admin.

1. On the portfolio's row, select Staff ("Staff - portfolio name").
2. Enter the Staff email and choose a Role: Manager (full write) or Viewer (read-only).
3. Select Grant access. The dialog lists "Current staff" with each member's role and a remove (revoke) action.

• Only users in your own MSSP organization can be granted. An email that is not one of your users returns "No such user in your organization", and users of client tenants can never be granted.
• Granting someone who already has access changes their role.
• Grants are checked on every request, so a revocation takes effect immediately.
• Users who hold at least one grant see a Group Admin entry in the sidebar.

Join Requests and Leaving

An organization that already has a Veltrix tenant can ask an MSSP to manage it. Both sides must agree.

As the client organization

1. Open Settings → Organization and find the Managed by an MSSP card (organization admins, organization:write).
2. Search for the MSSP by name ("Search MSSP by name...", at most 20 results; the search needs a query and only returns MSSP accounts).
3. Select Request on the right provider. The card then shows "Request pending to <MSSP>" with Cancel request.

• You can have only one pending request at a time, and you cannot request while already managed by an MSSP (leave first).
• When approved, the card reads "Managed by <MSSP>" with the portfolio name and a Leave MSSP button.
• The console's request form has no message field, although the API accepts an optional message.

As the MSSP

1. Open the MSSP console. A Join Requests section (with a count) appears when requests are pending. Each shows the tenant name, its contact email (or domain when there is no email), and any message.
2. Choose a portfolio you own from the dropdown for that request (defaults to your first portfolio) and select Approve, or select Decline (confirmation: "Decline <tenant>'s request to join?").
3. On approval the tenant joins the chosen portfolio and your staff grants on that portfolio apply to it.

Neither side can attach a tenant unilaterally: approval requires an existing pending request from the tenant, and the tenant cannot be added if it has since joined elsewhere.

Leaving

A managed tenant selects Leave MSSP and confirms. The dialog states that the organization and all its data (connections, configurations, users) stay with the tenant, that only the management relationship ends, and that the MSSP immediately loses access. The tenant becomes a regular direct account again, keeping all its data, and the MSSP's staff immediately lose access because the tenant is no longer in any portfolio the MSSP owns. The tenant can later request a different MSSP.

Group Admin Console

Group Admin is the console for working across a portfolio. Open Group Admin in the sidebar (route /group-admin); it appears for users holding at least one portfolio grant, and "Open Group Admin" on the MSSP console goes there too.

Screens

Tenant sections

• Branding: logo URL, primary color, and accent color. Managers can edit; viewers see the values.
• Entitlements: quota overrides (Max Users, Max Tools, Max Components, Max Canvases) and contract start and end dates. Managers can edit; viewers see the current values or "Tier default".
• Inventory: the tenant's connections, access servers, environments, configurations by status, and recent deployments. Read-only for everyone.
• Recent Activity: a merged feed of deployments, configuration changes, app installs, and audit events for that tenant.
• Users: the tenant's users with role, status, and last login.

Viewer and Manager

Rules that bound a manager

• Entitlements have caps. Each override must not exceed the lower of your own MSSP account's effective entitlement and a bounded multiple of the tenant's plan default. A request above the cap is rejected with the maximum shown.
• The plan and status stay with the platform. A group admin cannot change a tenant's subscription tier or status through entitlements. (Enable and Disable Tenant is a separate, manager-only action.)
• Users: "Add User" asks for email, optional first and last name, and a role chosen from the tenant's roles. Administrator-level (all-access) roles are not offered and are refused by the server, so a Group Admin can never create an administrator in a client tenant. The new user is a local account with a generated temporary password shown once. The tenant's own user quota applies; a full quota is refused. Reset Password invalidates the current password immediately. Platform admins and fellow group admins of the same portfolio cannot be deactivated or reset.
• Impersonated sessions cannot enter Group Admin.
• Group Admin does not let you edit a tenant's canvases, approve changes, or deploy. To work inside a client's configuration, staff use user accounts in that tenant with scoped roles, as described in the use case.

Auditing Delegated Actions

Every Group Admin request that clears the access check is recorded in the platform audit log, marked as delegated, with the acting user, the target tenant and portfolio, the method and path, the result, and the IP address. Changes a Group Admin makes to a tenant (anything other than reading) are also written to that tenant's own audit trail.

• A client looking at Reports → Audit Logs sees an MSSP manager's changes to their tenant, attributed to the acting user with the label "(delegated group admin)" and marked delegated in the details. Read-only browsing is recorded only in the platform log.
• A tenant's Recent Activity feed in Group Admin includes platform actions targeted at that tenant.
• The MSSP console's own actions (creating portfolios, onboarding, granting staff, approving requests) are logged to the server log, not to a tenant-visible audit report.

Permissions

MSSP console and Group Admin endpoints use portal sign-in (bearer token) and are not available to API keys. Roles for ordinary users are described in Access Control.

What It Does Not Do

• No cross-tenant baseline rollouts. You cannot push one configuration to several client tenants from the console. Configuration is authored, approved, and deployed inside each tenant.
• No consolidated reporting. Reports and audit logs are per tenant. The portfolio screen gives operational counts (connections, access servers, configurations, pending approvals, users, last activity), not a combined compliance or audit report.
• No email notifications for join requests, approvals, or tenant changes. Requests appear in the MSSP console, and clients see their status on the Organization page.
• No MSSP billing or white-label billing. Branding is a logo and two colors; billing and plan changes are not handled in the console.
• No SCIM, and SAML is not offered as an available feature; do not plan MSSP staff provisioning around either.
• Staff are your own organization's users. Client-tenant users cannot be granted portfolio access.

Gotchas

• Deleting a portfolio ungroups its tenants; it never deletes them. Their data is untouched and your staff lose access.
• Leaving or being ungrouped ends MSSP access immediately; there is no grace period.
• The temporary password for a new tenant admin or user is shown once. Copy it before closing the dialog.
• A portfolio name must be unique across the whole platform, not just your account.
• A tenant that is already in a portfolio cannot request a different MSSP until it leaves.
• Portfolio rename and description edits exist in the API only.
• New onboarded tenants start on the default plan; check that plan's limits before promising capacity to a client.