Skip to main content

Product Access Control

Product access control determines which products each user in your organization can access. This is managed at two levels: the organization level (which products are enabled) and the user level (which users can access each product).

🔒 products.*(Owner or Admin)

Organization-Level Access​

Before any user can access a product, it must be enabled for your organization. The products available to your org are determined by your subscription.

To view enabled products:

  1. Go to Settings > Products in Hub
  2. You'll see all products with their status: Active, Trial, or Not Subscribed

Only Owners can add or remove products from the organization's subscription (see Billing).

User-Level Access​

Once a product is enabled for your org, Admins and Owners can grant access to individual users.

Granting Access​

  1. Go to Settings > Users
  2. Click on a user's name
  3. Select the Product Access tab
  4. Click Grant Access next to the product
  5. Choose the roles and permissions for that product
  6. Click Save

Revoking Access​

  1. Open the user's profile
  2. Go to the Product Access tab
  3. Click Revoke next to the product
  4. Confirm

Revocation is immediate. The product will disappear from the user's waffle menu on their next page load.

What Users See​

Users only see products they have access to. The waffle menu, unified search, and Jarvis AI all respect product access — a user without Defend access won't see Defend alerts in search results or be able to ask Jarvis about security incidents.

ℹī¸Product access is binary for the waffle menu — either you can see the product or you can't. What you can do within a product is controlled by permissions.

Staff Access vs. Client Access​

Some products have two access modes:

  • Staff access — for your internal team (technicians, admins, managers)
  • Client access — for your MSP's clients, typically through Portal

Client access is managed through Portal's own user system, not Hub's user management. Hub handles staff identity; Portal handles client identity.

Product-Specific Onboarding​

When a user accesses a product for the first time, some products show an onboarding flow:

  • PSA — guides you through service board setup
  • CRM — walks you through importing contacts
  • Defend — helps you deploy your first agent
  • RMM — provides agent download links

These flows only appear once per user per product.