> ## Documentation Index
> Fetch the complete documentation index at: https://docs.certgovernance.app/llms.txt
> Use this file to discover all available pages before exploring further.

# MSP Setup & Customer Management

> Provision customer organizations, manage staff access, and apply onboarding templates.

## Prerequisites

* An MSP or Partner license (contact [sales@certforge.xyz](mailto:sales@certforge.xyz))
* Admin or superuser role in your CertForge org

Once your license is active, **MSP Dashboard** and **Onboarding Templates** appear in the left navigation.

## Provisioning a customer org

<Steps>
  <Step title="Open the MSP Dashboard">
    Navigate to **MSP Dashboard** in the left nav. Click **+ Add Customer**.
  </Step>

  <Step title="Fill in org details">
    | Field                 | Description                                                                |
    | --------------------- | -------------------------------------------------------------------------- |
    | **Organization name** | The customer's display name                                                |
    | **Slug**              | URL-safe identifier (auto-generated; can be edited)                        |
    | **Domain**            | Customer's primary email domain (used for SSO matching)                    |
    | **Admin email**       | An invitation is sent to this address to set up the customer admin account |
    | **Data region**       | Which node to create the org on (leave blank for local)                    |
  </Step>

  <Step title="Submit">
    Click **Provision**. CertForge creates the org, registers it as your customer, and adds your MSP org as a guest admin immediately. The designated admin receives an invitation email.
  </Step>
</Steps>

<Note>
  If the customer already has an existing CertForge org, they can invite your MSP instead: their admin goes to **Organization → Guest Members** and invites your org's email domain. The org will then appear in your MSP dashboard automatically.
</Note>

## Applying an onboarding template

Onboarding templates let you apply a standard configuration (Domain Trust Profiles, issuance profiles, alert rules) to a new customer org in one step.

**Create a template:**

1. Go to **Onboarding Templates → New Template**
2. Configure the DTPs, policies, and alert rules you want as your baseline
3. Save the template with a name (e.g., "SMB Standard" or "Healthcare Baseline")

**Apply a template:**

1. From the **MSP Dashboard → Customers** tab, open the customer org's detail panel
2. Click **Apply Template**, select the template, and confirm
3. CertForge creates the configured DTPs and policies in the customer org

<Warning>
  Applying a template adds to the customer's existing configuration — it does not replace or remove anything already there.
</Warning>

## Managing staff access

Staff access lets your team members work inside customer orgs without the customer needing to manually invite each person.

<Steps>
  <Step title="Open Staff Access tab">
    Go to **MSP Dashboard → Staff Access**.
  </Step>

  <Step title="Look up a staff member">
    Enter their email address and click **Load**.
  </Step>

  <Step title="Set per-org access">
    For each customer org, choose a role and optionally restrict access to specific DTPs.

    | Role         | What they can do             |
    | ------------ | ---------------------------- |
    | **—** (none) | No access to this org        |
    | **Viewer**   | Read-only access             |
    | **Operator** | Submit certificate requests  |
    | **Approver** | Approve certificate requests |
    | **Admin**    | Full org management          |

    To restrict to specific DTPs, uncheck **All DTPs** and select the DTPs this person should see. DTP-scoped staff cannot access other DTPs or org-level settings.
  </Step>

  <Step title="Masked identity (optional)">
    Enable **Masked identity** to hide this staff member's email from the customer's audit trail. Their actions are recorded as a generic MSP identity. Use this when customer-facing audit logs should not expose your internal staff names.
  </Step>

  <Step title="Save">
    Click **Save Access**. The staff member can now switch into the customer org using the org switcher.
  </Step>
</Steps>

## Removing a customer

To remove a customer org from your MSP dashboard:

1. Open the customer org card and click **Remove from MSP**
2. Confirm the action

This removes your MSP's guest access and all staff memberships from that org. **The customer's org, data, and certificates are not affected** — the org continues to operate independently.

## Compliance report

The **Compliance Report** tab shows a cross-org certificate health summary:

* Orgs with expired certificates (highlighted in red)
* Orgs with certificates expiring in 7 or 30 days
* Orgs that are fully clean

Click **Download CSV** to export the report for use in client deliverables.