Sign in
Stable

One scoped service account for delegated customer operations

Use scoped service accounts for partner operations across delegated customer workspaces without sharing administrator accounts.

Steps

Follow these in order.

  1. 01Automation gets a narrow identityService accounts should have exactly the operations they need: create customer workspaces, configure apps, inspect status or export events depending on delegated scope.
  2. 02Where partners use it firstThe practical first use is not a new platform. It is reducing repetitive setup and support operations across many customer workspaces.
  3. 03Partner automation, not full reseller platformPartner-branded billing, legal identity, support desk, email sender and customer-portal white-labeling are available only when they are explicitly included in a partner rollout.

Reference

Implementation details for setup and review.

Partner operationsAn MSP with forty clients should not automate through browser sessions that belong to individual administrators. Partner API access gives automation a scoped service account, delegated workspace boundaries and auditable operations.
  • Scoped service accounts
  • Delegated workspace operations
  • No shared administrator account
  • Audit-friendly automation
Automation gets a narrow identityService accounts should have exactly the operations they need: create customer workspaces, configure apps, inspect status or export events depending on delegated scope.
  • Least-privilege scope: API credentials are issued with explicit scopes instead of reusing an owner browser session.
  • Delegated customers: Partner operations can be limited to customer workspaces that delegated access to the partner.
  • Rotation and audit: Credential lifecycle should be visible, rotated and tied to audit events.
Where partners use it firstThe practical first use is not a new platform. It is reducing repetitive setup and support operations across many customer workspaces.
  • Create or update customer app configurations.
  • Check connector and private-app readiness.
  • Export operational events into partner tooling.
  • Rotate partner-owned credentials without sharing human passwords.
Partner automation, not full reseller platformPartner-branded billing, legal identity, support desk, email sender and customer-portal white-labeling are available only when they are explicitly included in a partner rollout.
  • No shared administrator account as the automation model.
  • The API is not intended for platform-wide administration.
  • A full partner-branded platform is not included.