Cross-tenant administration
Platform Admin Guide
For InspectAssets global/platform administrators operating above individual customer tenants.
Platform/global administration scope required
Keep platform context and tenant context separate
Platform tools manage InspectAssets across organisations. Tenant tools manage one customer's data. When you use Act as tenant, always verify the selected organisation before changing users, sites, billing or configuration.
Platform Dashboard
The Platform Dashboard gives a platform-wide view of tenant access, subscription attention, security findings, unprovisioned signup payments and platform health. Use it to identify items that need investigation, then open the relevant platform console for the full record.
Platform users and support roles
Global Admin manages platform staff separately from tenant users. Platform Support User (Level 1) accounts work the platform support queue, reply to requests and escalate cases that need second-level action. Platform Support Manager (Level 2) accounts can manage the wider support queue and, for a valid escalated MFA recovery case, perform the audited MFA reset. Tenant administrators cannot create platform support accounts.
Platform support staff use the Platform Support Dashboard and Support Console. Their dashboard shows real support workload such as assigned, unassigned and escalated tickets, MFA recovery requests and SLA exposure according to their access.
Tenants
Platform tenant management lists customer organisations and their high-level status/configuration. Creating, disabling or changing a tenant can affect every user in that organisation, so confirm the tenant identity and commercial/support context before action.
Act as tenant
Many organisation-level pages require a selected tenant. Enter tenant context only for the intended support/administrative task and leave it when finished. Do not use platform-wide access as a reason to bypass normal tenant permission design.
Platform Health & dependency security
System health and security/dependency views support platform operations. Treat security findings as operational work and follow the platform's zero-vulnerability policy rather than suppressing warnings to make a check appear green.
Subscription plans and feature entitlement
Platform subscription controls define the capabilities a tenant plan can use. This entitlement layer is separate from user permissions: a user can have a permission while the tenant plan still does not enable the feature.
Billing and recovery
Platform billing tools support cross-tenant commercial administration and recovery/reconciliation scenarios. Enterprise invoice workflows can use the selected billing account/payer and effective tax profile. Do not infer tax treatment only from a site's operating country.
Billing Recovery exists to identify/reconcile paid or billing events that did not complete expected provisioning. Use protected recovery actions carefully and preserve the audit trail.
Currencies
Currency management affects platform pricing/billing calculations beyond a single tenant. Confirm the rate source and effective operational process before changing platform-wide values.
API keys
Platform-level API keys are distinct from tenant API keys. Apply least-privilege scope, do not expose secrets in tickets or screenshots, and rotate/revoke keys according to the integration lifecycle.
MFA recovery for tenant users
If a tenant user loses the device that holds an authenticator app and has no usable recovery code, the recovery must be tied to an actual open MFA / Account Recovery support ticket for that user. A Platform Support Manager (Level 2) or Global Admin can perform the reset; Level 1 support can investigate and escalate the case but cannot reset MFA.
- Open the MFA recovery case in the Platform Support Console and confirm that the ticket is linked to the affected tenant user.
- For Level 2 support, the case must first be escalated. Global Admin can intervene directly when required, but the linked support ticket is still mandatory.
- The operator verifies their own platform password and current MFA code and records the recovery reason.
- Confirm recovery. The affected user's current authenticator setup and recovery codes are revoked, active sessions are signed out, and a one-time recovery code is sent only to the user's already-verified email address.
- After verifying recovery, the user must choose whether to use Email MFA or set up a new authenticator app.
Do not use MFA recovery to change identity
MFA Recovery does not change the user's registered email address. If the user cannot access both the authenticator and the verified email address, stop the automatic recovery process and use the manual identity-verification/support procedure.
Support Console
The Platform Support Console is the working queue for InspectAssets support staff. Level 1 support can investigate, reply and escalate; Level 2 support can manage the team queue and perform authorised MFA recovery. Global Admin retains platform oversight and can create platform support accounts. Keep internal notes and customer-visible communications in their intended channels.
Tenant onboarding
Platform onboarding gives a cross-tenant view of implementation progress. The tenant's own onboarding page remains the organisation-facing execution view.
Audit Logs
Use cross-tenant audit visibility to investigate administrative changes and support actions. When an issue is tenant-specific, pair the audit event with the relevant business record rather than relying on the log alone.
Benchmarks, Referrals and Lead Ops
Platform Benchmarks support cross-tenant analytical views where enabled. Referrals manage attribution/referral operations. Lead Ops manages commercial lead workflows and is separate from customer inspection operations.
Platform access carries wider consequence
A global administrator can affect multiple customers. Prefer tenant-scoped actions when that is sufficient, verify context before every destructive or billing operation, and use impersonation only for controlled support scenarios that require it.