Account groups let you organize customer accounts into named collections, for example by region, practice, or support tier. You can filter the Accounts view by group, and you can scope role-based access control (RBAC) role assignments to a group instead of selecting every account one by one. You can also exclude specific accounts or groups from a role. Exclusions take priority over inclusions.
The tasks in this article are performed at the MSP level.
Plan your groups before you scope any RBAC roles to them:
-
Choose a clear name and description that identify the region, practice, or support tier. A name must be unique, must be between 3 and 128 characters long, and can contain only letters, numbers, and underscores. Avoid generic names in a production environment, and keep descriptions short so that Help Desk staff can see why the group exists.
-
A built-in All accounts group lists every customer account, and you can't edit or remove it. Leave it as the default catch-all, and create custom groups only for scopes that you will reuse in RBAC or filtering.
-
Access updates automatically when you add accounts to a group or remove them from it.
Only users with the Super Admin Nerdio Manager role can see the Account Groups tab and create, update, assign, and remove account groups.
Account groups are in the Accounts area at the MSP level, next to the Accounts list and the Import & Export tab.
To open Account Groups:
-
At the MSP level, select Accounts > View all accounts.
-
Select the Account Groups tab.
The tab lists each group with its name and description, when it was last updated, and its assigned accounts. To find a group, enter text in the search field, or use the filter to show only the groups that contain specific accounts. Select Refresh All to reload the list.
Create a named group with a short description. You assign customer accounts to it in the next task.
To create an account group:
-
On the Account Groups tab, select Add Account Group.
-
In the Create Account Group dialog box, enter the following information:
-
Name: Enter a name for the group, for example East_Coast_MW. The name must be unique and between 3 and 128 characters long, and can contain only letters, numbers, and underscores. Spaces and hyphens aren't allowed.
-
Description: Enter a short description of the group, up to 512 characters, for example Customer accounts managed by the East Coast team.
-
-
Select Save.
The new group appears in the Account Groups list, alongside the built-in All accounts group.
After you create the group, assign one or more customer accounts to it. An account can belong to more than one group.
To assign customer accounts to an account group:
-
On the Account Groups tab, open the Actions menu for the group.
-
Select Assignments.
-
In the Update Account Group Assignments dialog box, open the Assignments field, and then search for and select the customer accounts to include. Each selected account appears as a tag in the field.
-
Select Save.
You can change the name and description of a group. To change the accounts in a group, use the Assignments action, as described in the previous task.
To update an account group:
-
On the Account Groups tab, open the Actions menu for the group.
-
Select Update.
-
In the Update Account Group dialog box, change the Name or the Description.
-
Select Save.
Removing a group permanently deletes it and unassigns all of its accounts. The accounts themselves are not deleted.
Important
You can't undo this action. If a role assignment uses the group, the users in that assignment lose the access that the group gave them. Review the accounts in the group, and the role assignments that use it, before you remove it.
To remove an account group:
-
On the Account Groups tab, open the Actions menu for the group.
-
Select Remove.
-
In the Delete Account Group dialog box, confirm that you want to delete the group, and then select OK.
Use a group when you assign or edit an RBAC role, so that users get access to every account in the group. Optionally, exclude accounts or groups that must not receive the role.
To scope an RBAC role to an account group:
-
At the MSP level, navigate to System > RBAC > RBAC Roles.
-
Select Assign Role, or edit an existing role assignment.
-
Role: Select the role, for example a Help Desk role.
-
Accounts: Open the picker. Under Account groups, select the group. To give access to only that group, clear All accounts.
-
Optionally, under Exclude Accounts, select the accounts or groups that must not have access. Exclusions override inclusions.
-
Select Save.
Note
Some roles limit which accounts you can give them:
-
You can assign custom account groups to MSP-level roles. A role that applies to a single account, such as Account Admin or Account Help Desk, takes one account only.
-
The Super Admin role always has access to all accounts. You can't restrict it.
-
You can't combine All accounts with an individual account in the same assignment.
After you save the role assignment, check the following:
-
The group appears in the Account Groups list with the correct name and description.
-
The assigned customer accounts appear under the group.
-
The role assignment on the RBAC Roles page shows the account group in its accounts scope.
-
A user with the role can open the accounts in the group, and cannot open the excluded accounts. Have the user sign out and back in, or wait for the token to refresh, before you test.
-
Prefer stable group names. Renaming a group later can confuse operators who already use it in RBAC.
-
Scope Help Desk and similar roles to an account group instead of All accounts, unless the user needs access to every customer.
-
Pilot with one or two accounts before you assign an entire practice.
-
When you add a new customer account, add it to the correct group, so that RBAC scopes stay accurate without editing every role. Users whose role is scoped to the All accounts group get access to new accounts automatically. Users whose role is scoped to custom groups do not.
-
Document your exclusions, so that operators know why a user cannot open a specific account.
Raise a support ticket for this item.
Comments (0 comments)