Managed customers

Managed customer workspaces are an optional Stackyapper mode for MSPs, consultants, and other businesses that manage separate customer environments. The company-wide workspace, app, access, AI client, and Audit concepts still apply; each managed customer adds a separate workspace boundary that the provider administers from the Customers page.

Each row is a separate workspace boundary, not a label on shared data. The identity chips show which customers have their own directory rather than inheriting yours. Your own workspace is pinned to the top and marked **Your workspace**; it is not a managed customer, so it is not counted as one and has no **Manage** or **Open workspace** action.

The Customers page in the portal. Contoso MSP is marked Your workspace, followed by three managed customers — Northwind Traders, Fabrikam, and Tailspin Toys — with lifecycle status, identity indicators for SCIM, SSO, and domain, thirty-day activity, user and app counts, and last activity. The page counts three customers across four rows. — Each row is a separate workspace boundary, not a label on shared data. The identity chips show which customers have their own directory rather than inheriting yours. Your own workspace is pinned to the top and marked **Your workspace**; it is not a managed customer, so it is not counted as one and has no **Manage** or **Open workspace** action.

The managing-account mental model

Your company workspace and each customer workspace are separate containers. The managing account pays for everything and can administer customer workspaces, but nothing inside one workspace is visible from another.

	Managing workspace	Customer workspace
Users	Your staff	The customer's users (plus provider staff operating by role)
Apps	Connected for your own business	Connected separately for that customer
Credentials	Your provider accounts	That customer's provider tenant only
Policy	Grants and restrictions for your teams	Grants and restrictions for that customer's users
Audit	Your workspace's activity	Scoped to that customer; managing-account admins can filter across customers
Billing	Owns the subscription; managed customer workspaces bill here	No billing tab
Identity	Your SAML/SCIM configuration	Customer-owned SAML and SCIM included with the managed workspace
Custom domain	Your Business custom access domain	Separate hostname included with the managed workspace

Use a managed customer workspace when the customer requires distinct users, connections, policies, Audit scope, or lifecycle controls. Do not use naming conventions as a substitute for a workspace boundary.

See Workspace lifecycle for creating, offboarding, and archiving customer workspaces, Operate workspaces for day-to-day administration, and Identity & cloud access for the included customer identity controls and optional cloud permission packs.

Scope safety

Before configuring an app or changing access, confirm you are in the right workspace. Follow the Confirm Current workspace checklist.

Customer users should not receive access to the managing company's internal workspace unless that is an intentional exception approved by an administrator.