Identity & cloud access

Business includes customer management and workspace switching for verified MSPs and consultants. A workspace owner can request verification in Settings → Plan & billing → Subscription under Managed customers → Review eligibility. Stackyapper reviews the business type and company website before granting access.

Two per-customer capabilities can be enabled from the customer's management page on Customers. They are separate controls, and neither automatically grants Stackyapper tools to customer users.

Capability	What it governs	Where to enable it
Managed customer identity	Who can sign in to the customer workspace: customer-owned SAML and SCIM	Customers → View → Identity
Cloud permission pack	Which documented Microsoft 365 or Google Workspace provider access is approved for the customer	Customers → View → Cloud access

Managed customer identity

Customer-owned SAML, SCIM, and automated identity lifecycle are included with every active managed customer workspace. There is no separate identity charge. Custom access domains require Business and approved MSP or consultant verification. See Plan and billing.

Configure identity in the customer context:

On Customers, select View on the customer and open the Identity tab.
Under SAML single sign-on, enter the customer's verified domain, the IdP issuer, and the IdP metadata XML, then select Connect SAML. The issuer must exactly match the entity ID in the metadata. Each customer has one SAML connection; use Edit to replace its metadata.
If provisioning is required, select Generate token under SCIM provisioning. Copy the customer-scoped token right away; it is not shown again. Store it directly in the customer's identity provider with the SCIM endpoint shown on the tab.
Test with a customer user and verify they reach the customer workspace.

Do not reuse MSP SAML metadata, a SCIM token, or a custom hostname across customers.

Cloud permission packs

Permission packs describe predefined Microsoft 365 or Google Workspace access. All packs are off by default, and each pack is a separate provider credential boundary. Five packs are read-only; one (Identity Containment) is write-capable.

Foundation Read

Read-only tenant basics through an org-level read app.

Covers: users and account status, domains, groups and membership, license inventory, service health (Microsoft 365) / org metadata (Google)
Excludes: group or license changes, mail and file contents, user suspension

Endpoint Posture

Read-only device posture through a separate endpoint read app (Intune / ChromeOS and mobile).

Covers: managed devices, compliance or device status, OS and encryption status (Microsoft 365) / OS and management status (Google), stale-device reporting
Excludes: retire, wipe, lock, reset, policy changes

Security & Audit

Read-only security signals through a separate high-sensitivity read app; role-gated.

Covers: sign-ins and risky users, Defender incidents, audit activity, app grants (Microsoft 365) / login, admin, token, and Drive audit activity (Google)
Excludes: remediation, session revocation, account suspension

Configuration Posture

Read-only policy posture through a separate configuration read app.

Covers: Conditional Access visibility (Microsoft 365) / OAuth app access posture (Google), auth method posture, sharing posture, forwarding posture, policy summaries
Excludes: policy create, update, assign, or delete

Knowledge Search

Read-only content search through a resource-scoped content app with an explicit allowlist.

Covers: selected SharePoint sites, OneDrive locations, or Google Shared Drives, folders, and files only
Excludes: tenant-wide content access, file writes, sharing changes, personal mail

Identity Containment

Write actions through a dedicated containment write app. Exact-argument confirmation and MSP approval are always required.

Covers: revoke sessions and tokens, disable or suspend a compromised account, remove an identified risky app grant or OAuth token
Excludes: create or delete users, password resets, role assignment, group or license management

Rules across all packs

A call runs only when provider consent, workspace policy, and action-time confirmation all allow it.
No pack exposes arbitrary Graph, Google API, PowerShell, or HTTP access.
Full revocation takes two steps — see the revocation note at the end of this page.

Pack documents are versioned and append-only; the current version (2026-07-18.1) is published at /docs/customer-cloud-permission-packs/2026-07-18.1 and shown in the portal. When the documentation version changes, a pack enabled under an earlier version shows as disabled until you review the current included and excluded capabilities, acknowledge them, and enable it again.

Before enabling a pack

On the customer's Cloud access tab, choose Microsoft 365 or Google Workspace, and read the pack's Permission details and the linked versioned permission documentation.
Confirm the provider tenant belongs to the selected customer, and that the pack is required for the intended workflow.
Select the acknowledgement checkbox, then Enable. Only an owner of the managing workspace can enable the write-capable Identity Containment pack.
Complete customer administrator consent in the provider, then verify that the returned provider tenant or domain is the intended customer.
Grant Stackyapper tools separately through customer workspace policy.

Enabling a pack records that the documented provider access is approved for this customer. It does not complete provider authorization or grant tools to customer users.

To revoke a pack, disable it in Stackyapper and revoke the corresponding enterprise application, OAuth grant, or domain-wide-delegation client in the customer’s provider console.