Skip to content

Roles & Access

Access for your staff has two independent axes: what they can do (role) and which clients they can do it to (tenant scope). This is separate from the tenant permission tier, which controls what Watchmont can do inside a customer's tenant.

The four roles

The capability hierarchy is SuperAdmin > Admin > Engineer > User. Each level is a superset of the one below.

RoleCan do
SuperAdminEverything, including system settings: staff management, tenant provisioning, integrations config, report & sync scheduling, billing pages.
AdminAll client work and actions (offboard, MFA reset, edit Conditional Access), but not system settings.
EngineerClient work and most actions, gated to read/write tenants. Day-to-day engineering.
UserRead-only. View dashboards and reports, cannot make changes.

Role changes need a re-login

The role lives inside the sign-in token. When you change someone's role, they must log out and back in before it takes effect.

Per-client scoping

Independently of role, each account has an allowed clients list:

  • All clients (default): no restriction.
  • A specific list: only those clients. Cross-tenant views (picker, dashboard, alerts) are filtered to that set.
  • SuperAdmins always see all clients.

Per-page grants in the portal

On top of the role, each staff account carries page grants that shape the portal navigation: a view grant per area (dashboard, alerts, clients, reports, users, secure) and act grants for pages with actions. Staff can also be grouped into departments that share a grant set. Both are managed under Admin › Settings › Staff Users.

Onboarding a scoped engineer

  1. Admin › Settings › Staff Users to create the account.
  2. Set the role to Engineer and grant the pages they need.
  3. Set Client Access to the specific clients (untick "All clients", tick the ones they manage).
  4. Have them log in with their Microsoft account. The scoped session is created on first sign-in.

Two gates on every write action

A write only succeeds when both are true:

  1. The staff member's role is high enough (Engineer or above; system settings need SuperAdmin).
  2. The tenant is provisioned read/write.

Internal & partner documentation.