Appearance
Roles & Access
Access for your staff has two independent axes: what they can do (role) and which clients they can do it to (tenant scope). This is separate from the tenant permission tier, which controls what Watchmont can do inside a customer's tenant.
The four roles
The capability hierarchy is SuperAdmin > Admin > Engineer > User. Each level is a superset of the one below.
| Role | Can do |
|---|---|
| SuperAdmin | Everything, including system settings: staff management, tenant provisioning, integrations config, report & sync scheduling, billing pages. |
| Admin | All client work and actions (offboard, MFA reset, edit Conditional Access), but not system settings. |
| Engineer | Client work and most actions, gated to read/write tenants. Day-to-day engineering. |
| User | Read-only. View dashboards and reports, cannot make changes. |
Role changes need a re-login
The role lives inside the sign-in token. When you change someone's role, they must log out and back in before it takes effect.
Per-client scoping
Independently of role, each account has an allowed clients list:
- All clients (default): no restriction.
- A specific list: only those clients. Cross-tenant views (picker, dashboard, alerts) are filtered to that set.
- SuperAdmins always see all clients.
Per-page grants in the portal
On top of the role, each staff account carries page grants that shape the portal navigation: a view grant per area (dashboard, alerts, clients, reports, users, secure) and act grants for pages with actions. Staff can also be grouped into departments that share a grant set. Both are managed under Admin › Settings › Staff Users.
Onboarding a scoped engineer
- Admin › Settings › Staff Users to create the account.
- Set the role to Engineer and grant the pages they need.
- Set Client Access to the specific clients (untick "All clients", tick the ones they manage).
- Have them log in with their Microsoft account. The scoped session is created on first sign-in.
Two gates on every write action
A write only succeeds when both are true:
- The staff member's role is high enough (Engineer or above; system settings need SuperAdmin).
- The tenant is provisioned read/write.