Teams, roles and user access in SuperIT

How SuperIT organises service provider and managed teams, what each role can do, and how to add users

SuperIT keeps each organisation's tickets, devices, chats and settings in a team. MSPs and IT teams start with one service provider team for their own staff. An MSP also has one managed team for each customer. Every person in a team has a role, Admin, Engineer or User, that decides what they can see and change. You manage people under Settings → User access.

Team types

Team type	What it is	How it is created
Service provider team	Your own team (for an MSP, the MSP's team). It owns the PSA connection and the settings that apply to every customer. Its settings sidebar group is called Global settings. Earlier versions of these docs called this a "manager team".	Created when you sign up for SuperIT.
Managed team	One team per customer company. It holds that customer's tickets, devices, users and chats. Its settings sidebar group is called Team settings.	Created automatically when you add a PSA company as a managed team. See Link PSA companies to teams.

Use the team switcher in the top-left corner of the app to move between your service provider team and each managed team.

Link PSA companies to managed teams

Your PSA connection lives on the service provider team. To add PSA companies as managed teams:

On the service provider team, go to Settings → Integrations → PSA provider, open your connection and select Manage teams.
On Add managed teams, find the companies on the Not added tab, select them and select Add team (or Add teams).
To link your own internal company to the service provider team, use Linked internal company.

When a SuperIT admin on the service provider team adds a PSA company as a managed team, SuperIT:

Creates a managed team named after the PSA company, or reuses the managed team the company was linked to before.
Copies every Admin and Engineer from the service provider team into the new managed team with the same role.
Copies the service provider team's Language setting to the new team.
Starts syncing that company's contacts and tickets into the managed team.

Tickets from that company then belong to the managed team. A company can also be linked to the service provider team itself, for your own internal company's tickets.

The steps differ slightly per PSA. See ConnectWise companies, Autotask companies and Halo clients.

What managed teams inherit from the service provider team

Some settings are set once on the service provider team and apply to every managed team. A managed team cannot change these:

Setting	Where it is set	What the managed team sees
PSA connection (credentials, filters, webhooks)	Service provider team, Settings → Integrations → PSA provider	No PSA connection of its own.
Custom triage instructions (status categories and AI instructions)	Service provider team, Settings → Ticket automation	The Custom triage instructions tab is hidden.
AI Agent Name	Service provider team, Settings → General → AI assistant	The field is read-only: "This is set by your service provider and cannot be edited here."
Billing	Service provider team	The Billing page is hidden. The managed team uses the service provider's subscription.

Each managed team keeps its own copy of these, and its admins can change them:

Settings → Ticket automation → Automation settings (new teams start on Balanced), including Fields automated triage may not change. A service provider admin can push one blocked-fields list to many managed teams with Apply to managed teams…; it replaces each team's list. See Ticket automation.
Language and Team Context. See AI assistant settings.
Settings → Command policies. See Command policies and approvals.
Settings → Integrations → Identity provider (Microsoft 365). See Microsoft 365.
Users and roles under Settings → User access.

Who can see what between a service provider and its customers

Service provider team: Admins and Engineers on the service provider team can see tickets from every managed team. Each ticket shows which customer it belongs to.
Managed teams: a managed team sees only its own tickets, devices, users and chats. It cannot see other managed teams or the service provider team's data.
Members of both: service provider staff added to a managed team (automatically at link time, or later) see that team's data while they have it selected in the team switcher.
Users with the User role on the service provider team see only their own tickets.

Credentials are not shared downwards:

The PSA credentials stay on the service provider team. Managed teams use them only indirectly, through the synced tickets.
Microsoft 365 is connected per team. Connecting it on the service provider team does not connect it for a customer.
Workflow credentials belong to the team they were created in.
Devices are enrolled into a team with that team's install key. See Install the SuperIT RMM agent.

Roles

SuperIT offers three roles in the UI. A person can hold a different role in each team.

What you can do	Admin	Engineer	User
See tickets, chats and devices	All in the team	All in the team	Only their own
See internal notes on tickets	Yes	Yes	No
Chat with SuperIT	Yes	Yes	Yes
Approve or deny commands in a chat	Yes	Yes	No. End users are never asked: a command that needs approval is denied automatically and SuperIT hands the issue to the IT team.
Turn on Auto-approve in a chat	Yes	Yes	No
Open Command Approvals to see command requests	Yes	Yes	No
View Settings → Command policies	Yes	Yes	No
Add, edit or delete command policy rules	Yes	No	No
View Settings → User access	Yes	Yes (read only)	No
Add users, change roles, send invites, manage groups	Yes	No	No
Create, edit and run workflows	Yes	Yes	No
Reports	Yes	Yes	No
Knowledge base and Insights	Yes	No	No
Settings → General, Ticket automation, Integrations, Billing	Yes	No	No
MSP Mode in chat (service provider teams)	Yes	No	No

SuperIT also uses two roles you cannot assign: System, the account the SuperIT agent runs as, and Inactive, a blocked membership that can only reach its own profile.

Add a user

You need the Admin role on the team.

Go to Settings → User access.
On the Team users tab, select Add user.
Enter First name, Last name and Email. The email should belong to a Microsoft 365 or Google Workspace account so the person can sign in with single sign-on. Otherwise, send them a password reset before their first sign-in.
Under Access, choose a role for the current team. You can also give the person a role in other teams you administer.
Select Create User.

To invite the person, open the row's actions menu and select Send invite.

Add users from Microsoft 365 or your PSA

Select the arrow next to Add user:

Add from MS365 lists users synced from your Microsoft 365 tenant. Select the users and confirm. Licensed users only hides unlicensed accounts. Each imported user is linked to their Microsoft 365 account. This option is available only after you connect Microsoft 365. See Microsoft 365.
Add from PSA lists contacts and members synced from your PSA. Each imported user is linked to their PSA contact, which is how SuperIT connects that person's tickets to them. A PSA contact without an email address is skipped. This option is available only when the team has a PSA connection.

Users imported either way get the User role.

Manage existing users

Each row on Team users has an actions menu. Admins see:

Edit user
Link M365 user / Unlink M365 user
Link PSA user / Unlink PSA user
Send invite
Send password reset
Change role
Manage groups
Remove from team

The Team users list shows each user's links in three columns:

Session: Verified if the user has a verified session on a device in this team, otherwise Unverified.
Identity: Linked if the user is linked to a Microsoft 365 account. A badge such as 1 match means SuperIT found an unlinked account with the same email; select it to link.
Ticketing: Linked if the user is linked to a PSA contact. A match badge works the same way.

SuperIT needs all three to find an end user's device from their ticket. See Check each end user's ticket, identity and device links.

Select several rows to use bulk actions, including Send invites, Send password resets, Add groups, Remove groups, Bulk link to M365 (exact email), Bulk link to PSA (exact email), Export users (CSV) and Remove from team. Exports are emailed to you.

Changing a user's email unlinks their Microsoft 365 and PSA accounts, signs them out of verified device sessions and invalidates their login tokens.

Service provider staff

The Service provider staff tab lists the staff (members) synced from your primary PSA connection. Admins see this tab.

On the service provider team, use it to add PSA staff as SuperIT users and give them roles in each managed team linked to the connection.
On a managed team, it shows only the PSA staff who have access to that team.

If no PSA is connected, the tab shows "Connect a PSA to see your service provider staff."

Groups (superit: and m365: tags)

Each team membership can carry group tags. They are used by workflow authorization policies to decide who may run or approve an action.

Tag prefix	Where it comes from	Can you edit it?
`superit:*`	Assigned by an admin with Manage groups or the Add groups bulk action.	Yes
`m365:*`	Synced from Microsoft 365 group membership for users linked to a Microsoft 365 account.	No. It changes when the Microsoft 365 group changes or the user is unlinked.