[Feature Request]: More Granular account permissions

[bonlewy]

Description of the new feature - must be an in-depth explanation of the feature you want, reasoning why, and the added benefits for MSPs as a whole.

We would like to add some more staff members to our CIPP platform, but, we dont want them to be able to do everything, such as not allowing access to:

• Transport Rules
• Intune
• Defender
• Anything under CIPP Settings
• Tenant Administration

Our CIPP instance is hosted so all we are able to currently do is add a user to the portal as Admin, Edit or Read Only. If we could add someone and then select what they can view, this would be great to then enrol 1st Line engineers into the portal

PowerShell commands you would normally use to achieve above request

No response

[KelvinTegelaar]

This has been discussed at length in other feature requests:: we're not planning on adding this as this would out on undue burden of maintaining a security system on us. We want to prevent being blamed for security failures that happen because a msp doesnt understand the complex setup or makes a mistake.

However you can check out docs for custom roles, which shifts this burden entirely to the msp themselves to maintain:

https://docs.cipp.app/setup/installation/roles

[bonlewy]

This has been discussed at length in other feature requests:: we're not planning on adding this as this would out on undue burden of maintaining a security system on us. We want to prevent being blamed for security failures that happen because a msp doesnt understand the complex setup or makes a mistake.

However you can check out docs for custom roles, which shifts this burden entirely to the msp themselves to maintain:

https://docs.cipp.app/setup/installation/roles

Im not sure from looking at this that it is possible to do it on the hosted platform, only if self-hosted on Azure?

[KelvinTegelaar]

As it says at the bottom:

If you are a hosted client, Custom Roles are supported by sending your configuration file to our helpdesk. :)