Accounts, roles and what you can see

MSPControl has one concept that explains most “why can’t I see that?” questions, and it surprises nearly everyone the first time: the menu is built from the account you are looking at, not from the account you signed in with.

This page explains the account model, the roles, and how the two combine to decide what appears on screen. It is worth reading before the service guides, because the structure it describes is also the structure of this manual.

Everything is an Account

There is no separate “provider portal” and “customer portal”. There is one hierarchy, and every entity in it is an Account:

Serveradmin  (the platform operator)
└── Reseller
    └── Customer

An Account owns Hosting Spaces. A Hosting Space owns Organizations.

Level	What it is	What it holds
Account	The commercial entity — platform operator, reseller, or customer	Hosting Spaces, peers, billing, hosting plans
Hosting Space	A provisioned bundle of services bought against a hosting plan	Websites, mail, databases, domains, FTP, IP addresses
Organization	The customer organization as represented inside MSPControl	Users, mailboxes, devices, Microsoft 365 and Azure services

This manual mirrors that chain: Accounts, Hosting Spaces and Organizations are top-level sections, with Platform Settings alongside for the platform-wide configuration only the operator sees.

'Serveradmin' is a convention, not a product term

The word does not appear anywhere in the product interface. The top-level account is simply an Account whose role is Administrator. It is used here because it is what people say.

The seven roles

A role is set on the Account and controls what that account may do.

Role	Typical holder
Administrator	The platform operator
Reseller	A partner reselling services under the operator
User	A customer — the account that actually owns Hosting Spaces and Organizations
PlatformCSR	Operator-side customer service
PlatformHelpdesk	Operator-side support
ResellerCSR	Reseller-side customer service
ResellerHelpdesk	Reseller-side support

The four CSR and Helpdesk roles are support-staff variants. For menu purposes they behave much like Administrator, and in one respect they see more than a Reseller does: Hosting Plans and Hosting Add-Ons are available to them directly, while a Reseller only sees those screens if the platform operator has enabled the corresponding policy.

Why the menu changes: two accounts, not one

Every menu item is tested against two accounts before it appears:

1. The signed-in account — who you are. Determines whether you are entitled to the feature at all.
2. The selected account — whose account you are currently administering, chosen through the account hierarchy. Determines whether the feature is relevant to what you are looking at.

Both tests must pass. A third check then applies the peer role permissions of the signed-in user to the individual item.

This is why an Administrator viewing their own account sees a short menu — Account, Dashboards and Settings — and no service menus at all. Mail, Databases, Web and Organizations only make sense against a customer, so they appear once you select one.

Expecting a menu that is not there?

Check what is selected in the account hierarchy before anything else. Most reports of a “missing” menu are a page being viewed against the wrong account, not a permissions fault.

What the selected account changes

Selected account’s role	What becomes available
Administrator or Reseller	Customers, Hosting Plans, Hosting Add-Ons, user invitations. The hosting-space and organization selectors are hidden entirely — these accounts sell services rather than consume them.
User	The full service surface: Organizations, Mail, Databases, Web, Voice, Hyper-V, Documentation and Marketplace — subject to what the hosting plan actually includes.

A few items are hidden specifically when an Administrator or Reseller views their own account. Subscriptions is one: you do not buy from yourself.

Three further things that gate a menu

Passing the role tests is necessary but not sufficient. An item can still be absent because of:

• Resource groups. A Hosting Space only offers the services its hosting plan provisioned. No mail service in the plan, no Mail menu.
• Quotas. Countable features check both the resource group and a quota. PBX Tenants, for example, needs the Voice resource group and a non-zero tenant quota.
• Peer roles. Individual items carry a permission that the signed-in user’s peer role must grant. Two people with the same account role can see different menus if their peer roles differ.

Read-only tenants

An Organization can be connected to Microsoft 365 with a read-only tenant application. MSPControl can then report on the tenant but not change it.

Where that applies, write-oriented menus are removed or trimmed rather than shown and disabled, and — importantly — settings saved before the tenant became read-only are ignored, not merely hidden. The compliance report says so explicitly rather than reporting those settings as enforced.

Related

• Architecture and components — the services behind the panel
• Peer roles — the per-item permission layer
• Hosting plans — what puts services into a Hosting Space