# MSP Portal Overview The WatchDog Security MSP Portal is designed for Managed Service Providers that manage multiple customer organizations within the WatchDog Security platform. :::info Who This Is For **MSP Owners** and/or **Administrators** responsible for onboarding and MSP Portal Management ::: It provides a centralized way to: - Manage MSP hierarchies - Control user access and permissions - Onboard and access customer tenants This article explains the core concepts you need to understand before performing any setup or onboarding actions. # MSP Nodes The MSP Portal is structured using **nodes**, which represent MSP entities within a hierarchical model. - **Parent Node:** The primary MSP node automatically created when the MSP tenant is provisioned. It represents the main organization and serves as the root of the hierarchy, inheriting visibility across all child nodes. - **Child Nodes:** Optional nodes created under the Parent MSP to segment teams, departments, or downstream MSP partners. Child nodes isolate users, roles, and managed companies while still operating under the parent organization. Visibility and access are controlled by permissions and node relationships. # MSP Roles and Permissions Access within the MSP Portal is controlled using role-based access control (RBAC). Permissions determine both visibility and action capability. Assigned to the primary contact when the MSP tenant is created. Provides unrestricted administrative access across the MSP Portal, including billing management and node administration. This role is permanent and cannot currently be edited, transferred, or removed. Automatically created with every MSP tenant, this built-in parent-level role cannot be deleted. It provides full administrative access across the Parent MSP node, equivalent to the MSP Owner role, except it does not include Billing Administrator permissions. Automatically created for each Child MSP node, this built-in role cannot be deleted. It provides administrative control within the specific Child node, aligned closely with MSP Owner permissions, but excludes node management, billing administration, and cascade permissions. MSP environments can create custom roles to tailor access based on operational responsibilities. - **Parent node custom roles:** Can be assigned any available MSP permissions and intended for organization-wide administrative or operational access - **Child node custom roles:** Apply only within the specific Child MSP node. Cannot include node management, billing administration, or cascade permissions # Managed Companies Customer organizations within the platform are referred to as **Managed Companies**. MSPs can: - Create Managed Companies within their MSP environment - Assign Managed Companies to specific MSP nodes - Access Managed Companies using the **Assume Tenant** functionality :::note[] Users do not automatically receive access to customer tenants. Access is granted only when explicitly allowed by the RBAC role assigned to the user. ::: Managed Companies operate independently, but their visibility and management are controlled by the node and role permissions assigned to the user. # Billing Responsibility :::check[] Billing must be configured before creating a Managed Company, except when provisioning NFR tenants. ::: The WatchDog Security MSP Portal tracks service usage at the Parent and Child node levels. Billing is calculated at the MSP environment level and is not automatically allocated to Managed Companies. MSPs remain responsible for invoicing and billing their own customers outside of the platform. Set up the billing profile required before onboarding customer organizations.