docs(msp): add Prowler for MSPs and MSSPs documentation (#12101)

This commit is contained in:
StylusFrost
2026-07-23 16:20:25 +02:00
committed by GitHub
parent 885555e080
commit b80e3a7bfb
20 changed files with 596 additions and 0 deletions
@@ -0,0 +1,62 @@
---
title: "Billing and Customer Plans in Prowler for MSPs and MSSPs"
sidebarTitle: "Billing and Plans"
---
Each customer carries its own billing plan, set when the customer is created and changed later from the **Customers** page. This page covers both, and where the resulting revenue is reported.
## Permissions
Managing customer plans requires a role with **Manage billing**, held today by both **Superadmin** and **Organization Admin**. See [Managing Your Team](/user-guide/tutorials/prowler-for-msps-team).
## Customer Plans
Plans are chosen in the **Set Their Billing Plan** step of the Add Customer wizard. A customer starts on a trial or on one of the paid plans, billed monthly or annually.
Each plan card in the wizard shows its own price, included usage and overage rate. For current pricing, see [prowler.com/pricing](https://prowler.com/pricing).
### Provider Accounts on the Annual Plan
The annual plan is paid upfront for a fixed number of cloud provider accounts, between **1 and 20**. You set that count when you pick the plan. The monthly plan does not require an upfront provider account count.
## Change a Customer's Plan
Open the actions menu on a customer's row and choose **Change plan**.
<Warning>
**Plan changes are one way: trial to paid.** The action is only offered while a customer is on trial or its trial has expired. Once a customer holds a paid subscription, **Change plan** no longer appears on the row, and the trial is never a valid target.
</Warning>
The **Change Plan** dialog opens on **Choose your plan**, with the same **Monthly** and **Annual** toggle used when the customer was created.
![Change Plan dialog](/images/prowler-for-msps/change-plan-dialog.png)
Select a plan and confirm with **Change Plan**. Choosing the annual plan also asks for the upfront provider account count. The change is submitted to Prowler Cloud and applied asynchronously; the customer's row updates once it lands. If it fails, a message explains why:
| Message | Cause |
|---|---|
| Cloud accounts count is required | The annual plan was selected without a provider account count. |
| Cloud accounts count out of range | The count is outside 120. |
| Company name is required | The customer record has no usable company name. |
| Customer not found | The customer no longer exists or is not linked to a tenant. |
## Revenue Reporting
Billing figures surface in two places.
**On the Customers page**, stat cards above the table summarize **Billing active** — how many customers hold an active subscription — and **Total MTD** per currency, with a percentage change against last month. The cards appear once a customer has billing activity.
![Billing stat cards above the customers table](/images/prowler-for-msps/customers-table.png)
**On the Dashboard**, the **Billing Overview** card reports monthly expenses against the previous month and splits revenue for the period into annual, monthly and overage, giving the same picture across every customer.
## Next Steps
<Columns cols={2}>
<Card title="Onboarding Customers" icon="building" href="/user-guide/tutorials/prowler-for-msps-customers">
Add customers and open their Prowler Cloud tenants.
</Card>
<Card title="Your Partner Organization" icon="briefcase" href="/user-guide/tutorials/prowler-for-msps-organization">
Lifecycle, settings, Partner Code and closing your organization.
</Card>
</Columns>
@@ -0,0 +1,66 @@
---
title: "Customizing Your Branding in Prowler for MSPs and MSSPs"
sidebarTitle: "Branding"
---
Upload your company logo to have it displayed alongside Prowler branding in the console. Branding is managed from **Settings → Branding** and requires a role with **Manage settings**.
## Upload a Logo
Open **Settings → Branding**, click **Upload Logo**, and pick your file. The logo replaces the placeholder immediately and a confirmation appears.
![Settings Branding tab](/images/prowler-for-msps/settings-branding.png)
### Logo Requirements
| Requirement | Value |
|---|---|
| **Formats** | PNG or SVG |
| **Maximum file size** | 512 KB |
| **Dimensions** | 200 × 60 pixels — a hard limit for PNG, not checked for SVG |
<Warning>
Two limits on this screen are looser than what the server accepts:
* The upload dialog accepts files up to 1 MB, but anything above **512 KB** is rejected.
* The page describes 200 × 60 pixels as a recommended size. For PNG it is a **maximum**: a larger PNG is rejected with *"PNG dimensions must not exceed 200×60 px."* SVG is exempt from the dimension check.
Keep PNG logos within both limits to avoid an upload that appears to start and then fails.
</Warning>
A wide, horizontal logo with a transparent background renders best. SVG stays crisp at every size, is not subject to the dimension limit, and is the better choice where you have it.
<Note>
Uploaded SVG files are sanitized on the server. Scripts, external references and other active content are stripped before the file is stored.
</Note>
## Replace or Remove a Logo
Uploading a new file replaces the current one. **Remove Logo** deletes it and returns the console to the default Prowler branding. Both take effect immediately for everyone on your team.
## Logo Placement Preview
Below the upload controls, **Logo Placement Preview** renders your logo underneath the Prowler wordmark, showing how the two are intended to sit together in a Prowler Cloud organization. With no logo uploaded, the slot shows a *Your Logo* placeholder.
<Note>
The preview is rendered locally in the console. Uploading a logo does not currently push it to Prowler Cloud.
</Note>
## Where Your Logo Appears
Your logo is shown alongside Prowler branding within the console for your team.
<Warning>
**Branding does not extend to Prowler Cloud.** Customers signing in at [cloud.prowler.com](https://cloud.prowler.com) see the standard Prowler interface. White-labeling Prowler Cloud is not supported.
</Warning>
## Next Steps
<Columns cols={2}>
<Card title="Your Partner Organization" icon="briefcase" href="/user-guide/tutorials/prowler-for-msps-organization">
Lifecycle, settings, Partner Code and closing your organization.
</Card>
<Card title="Managing Your Team" icon="users" href="/user-guide/tutorials/prowler-for-msps-team">
Invite team members and assign roles.
</Card>
</Columns>
@@ -0,0 +1,104 @@
---
title: "Onboarding Customers and Accessing Their Tenants"
sidebarTitle: "Onboarding Customers"
---
Adding a customer in Prowler for MSPs and MSSPs provisions a Prowler Cloud tenant for that organization and links it to yours. From then on you can open that tenant from the console and work inside it on the customer's behalf.
## Add a Customer
Select **Customers** in the sidebar, then click **Add Customer** to open a three-step wizard.
<Note>
Adding a customer is restricted to the Superadmin role. Organization Admins manage existing customers but do not see the **Add Customer** button.
</Note>
<Steps>
<Step title="Create A Customer Profile">
Enter the **Customer Business Name** and confirm the **Region**. The name must be unique within your partner organization; a duplicate is rejected inline. Click **Next**.
![Adding A New Customer, step one](/images/prowler-for-msps/add-customer-profile.png)
</Step>
<Step title="Set Their Billing Plan">
Under **Choose your plan**, switch between **Monthly** and **Annual** and pick the plan the customer starts on. Click **Create Customer**. See [Billing and Customer Plans](/user-guide/tutorials/prowler-for-msps-billing) for what the annual plan asks for.
![Adding A New Customer, choosing a plan](/images/prowler-for-msps/add-customer-billing.png)
</Step>
<Step title="Launch Their Customer Workspace">
A banner confirms the outcome — created on trial, or subscribed to a paid plan — and the tenant is created and linked to your organization. Click **Go To Organization** to head straight there and start connecting cloud providers, or **Close** to return to the customer list.
![Adding A New Customer, confirmation](/images/prowler-for-msps/add-customer-launch.png)
</Step>
</Steps>
Provisioning is asynchronous. The customer's row shows **Provisioning** until the tenant is ready, then switches to **Active**.
## The Customers View
**My Customers** lists every customer you can reach.
![My Customers page](/images/prowler-for-msps/customers-table.png)
Each row carries:
| Column | What it shows |
|---|---|
| **Customer Business Name** | The customer's name |
| **Providers** | Icons for each cloud provider connected in their tenant |
| **Cloud Accounts** | Number of provider accounts under scan |
| **Resources** | Resources discovered by the latest scan |
| **Failed Findings** | Failed findings from the latest scan |
| **Billing Type** | The customer's current plan, shown as **Trial**, **Pro Monthly** or **Pro Annual** |
| **MTD** | Month-to-date spend |
| **Last Month Expenses** | Previous month's total |
| **Status** | **Active**, **Provisioning** or **Inactive** |
| **Last scan completed** | When the most recent scan finished |
A customer shows as **Provisioning** while its tenant is being created, and **Inactive** once it has been marked for removal.
Above the table, search by name and filter by provider or status. The download button at the top right of the table exports the list.
## Open a Customer's Prowler Cloud Tenant
Open the actions menu at the end of a customer's row and choose **Access Organization**. You are redirected into that customer's tenant in Prowler Cloud, signed in as yourself acting on their behalf.
While you are in the tenant you see what a customer administrator sees, and every action is recorded in the Prowler Cloud audit log against both your identity and the customer you are acting for.
Opening a tenant requires a role with **Access tenants**. The action fails with a clear message if you lack permission, if the customer no longer exists, or if the tenant is not ready.
![Customer row actions menu](/images/prowler-for-msps/customer-row-actions.png)
**Change plan** only appears while the customer is on trial or its trial has expired. See [Billing and Customer Plans](/user-guide/tutorials/prowler-for-msps-billing).
## Edit a Customer
Choose **Edit** from the row actions to open the **Edit customer** panel and rename the customer. The new name must still be unique within the partner organization.
## Link an Existing Customer with Your Partner Code
Each approved partner organization carries a **Partner Code**, shown on **Settings → Profile** with the helper text *"Share this code with customers to link their accounts."* A customer who already runs Prowler Cloud can use that code to request a link to you, rather than having you provision a fresh tenant.
<Note>
The customer-side flow that consumes the Partner Code is rolling out progressively in Prowler Cloud. Confirm availability with your Prowler contact before sharing the code.
</Note>
## Customer Self-Access
Your customers keep signing in to [cloud.prowler.com](https://cloud.prowler.com) with their own users. Your access is additive — it neither replaces nor restricts theirs.
## Remove a Customer
Removing a customer detaches it from your partner organization and moves it to **Inactive**. It does not delete the customer's data in Prowler Cloud; contact Prowler to arrange the offboarding of the tenant itself.
## Next Steps
<Columns cols={2}>
<Card title="Billing and Customer Plans" icon="credit-card" href="/user-guide/tutorials/prowler-for-msps-billing">
Customer plans and revenue reporting.
</Card>
<Card title="Managing Your Team" icon="users" href="/user-guide/tutorials/prowler-for-msps-team">
Invite team members and assign roles.
</Card>
</Columns>
@@ -0,0 +1,90 @@
---
title: "Managing Your Partner Organization"
sidebarTitle: "Your Partner Organization"
---
Your partner organization is the top-level container in Prowler for MSPs and MSSPs. It holds your team, your branding, your Partner Code and every customer whose Prowler Cloud tenant you operate.
## Lifecycle
A partner organization moves through four states:
| State | Meaning |
|---|---|
| **Pending email verification** | The first administrator has signed up but has not yet clicked the verification link. |
| **Pending approval** | Email verified. Prowler is reviewing the application. |
| **Active** | Approved. The organization can sign in, invite team members and onboard customers. |
| **Rejected** | Prowler reviewed and declined the application. The account cannot sign in. |
A rejection email carries the reason, categorized as **Incomplete documentation**, **Not eligible**, **Duplicate** or **Other**.
## Settings
Open **Settings** from the sidebar. The page has three tabs — **Profile**, **Branding** and **Security** — though what you can do in them depends on your role.
Every signed-in user can view the settings and change their own password. Editing the organization itself requires a role with **Manage settings**; without it, only the **Security** tab is available.
### Profile
The **Profile** tab shows the **Partner Information** card: your organization name, its current status, the date it joined, the Partner Code and an editable **Company Name**.
![Settings Profile tab](/images/prowler-for-msps/settings-profile.png)
* **Partner Code** — a read-only, Prowler-issued identifier in the form `PRW-00000`. The helper text reads *"Share this code with customers to link their accounts."* Copy it with the button at the end of the row.
* **Company Name** — the display name used in the console, in invitations and in outbound email. Edit it and click **Save Changes**.
### Branding
Upload your logo. See [Customizing Your Branding](/user-guide/tutorials/prowler-for-msps-branding).
### Security
Change your own password. Roles with **Manage settings** — Superadmin today — also reach the Danger zone described below. An Organization Admin sees the password form only.
## Customer Capacity
Each partner organization has a cap on how many customers it can hold at once. The default is **50**. To raise it, contact Prowler.
## Closing Your Organization
Deleting a partner organization is a request, not an immediate action.
<Steps>
<Step title="Open the Danger zone">
Go to **Settings → Security**. The Danger zone and its **Delete Partner** action require a role with **Manage settings**.
</Step>
<Step title="File the request">
Optionally give a reason in **Reason for deletion**, then type `DELETE` in the confirmation field to enable the button and submit.
</Step>
<Step title="Wait for review">
Filing the request notifies the Prowler team and sends a confirmation to the requester. The Danger zone then reports that a deletion request is already pending review. You and your team keep full access while it is pending.
</Step>
<Step title="Offboard with Prowler">
The Prowler team coordinates the offboarding from there, including what happens to each customer tenant and when your organization is closed. Closing removes the partner organization, its team memberships and its branding assets, and invalidates every session.
</Step>
</Steps>
<Note>
Closing a partner organization does not delete customer data in Prowler Cloud on its own. The Prowler team confirms the handling of each customer tenant as part of the offboarding.
</Note>
## Ownership
One user is the **owner** of the partner organization — by default, whoever signed up. Ownership can be transferred to another team member, who keeps the Superadmin role. The owner cannot be removed from the team while they hold ownership.
## Next Steps
<Columns cols={2}>
<Card title="Managing Your Team" icon="users" href="/user-guide/tutorials/prowler-for-msps-team">
Invite team members and assign roles.
</Card>
<Card title="Customizing Your Branding" icon="palette" href="/user-guide/tutorials/prowler-for-msps-branding">
Upload your logo.
</Card>
<Card title="Onboarding Customers" icon="building" href="/user-guide/tutorials/prowler-for-msps-customers">
Add customers and open their Prowler Cloud tenants.
</Card>
</Columns>
@@ -0,0 +1,88 @@
---
title: "Sign Up and Sign In to Prowler for MSPs and MSSPs"
sidebarTitle: "Sign Up and Sign In"
---
Sign-up for Prowler for MSPs and MSSPs is self-service, but activation requires approval from the Prowler team. The first administrator registers the partner organization; every other team member joins by invitation.
## Sign Up
<Steps>
<Step title="Open the sign-up page">
Go to [partners.prowler.com/sign-up](https://partners.prowler.com/sign-up), fill in **Full name**, **Company name**, **Email**, **Password** and **Confirm password**, then click **Create account**.
![Create your account form](/images/prowler-for-msps/sign-up-form.png)
</Step>
<Step title="Verify your email">
Prowler sends a verification email containing a one-time link valid for **24 hours**. Click it to confirm the address; your partner organization then moves to **Pending approval**.
If the link expires, request a new one at [partners.prowler.com/resend-verification](https://partners.prowler.com/resend-verification). Issuing a fresh link invalidates any earlier unused link for the same account.
</Step>
<Step title="Wait for approval">
Prowler reviews every new application. You receive an email when the organization is approved — its status becomes **Active** — or when it is rejected, along with the reason.
</Step>
<Step title="Sign in">
Once approved, sign in at [partners.prowler.com](https://partners.prowler.com) with the email and password you chose. You land on the Dashboard.
</Step>
</Steps>
## Password Requirements
Every password in the console — at sign-up, when accepting an invitation, and on reset — must satisfy all of the following:
| Requirement | Rule |
|---|---|
| **Length** | At least 12 characters |
| **Uppercase** | At least 1 uppercase letter |
| **Lowercase** | At least 1 lowercase letter |
| **Number** | At least 1 digit |
| **Special character** | At least 1 special character |
| **Not common** | Rejected if it appears on the common-password list |
| **Not similar to your details** | Rejected if too close to your name or email |
## Sign In
Sign in at [partners.prowler.com](https://partners.prowler.com) with your email and password, then click **Login**. Select **Remember me** to keep the session alive longer between visits.
![Sign In screen](/images/prowler-for-msps/sign-in-form.png)
Sign-in fails while the partner organization is not yet active:
| Message | What it means |
|---|---|
| Invalid email or password | The credentials do not match an account. |
| Please verify your email before signing in | Email verification is still outstanding. Open the verification email or request a fresh link. |
| Your partner application is still under review | Prowler has not approved the application yet. |
| Your partner application was not approved | The application was rejected. The account cannot sign in. |
## Reset a Forgotten Password
Click **Forgot Password?** on the sign-in screen and enter your email. Prowler sends a reset link valid for **15 minutes**. The reset page asks for a new password and a confirmation; on success you return to sign-in.
<Note>
The confirmation banner appears whether or not the email matches an account, so the screen never reveals which addresses are registered. Requesting a new link invalidates any earlier unused one.
</Note>
## Sessions
Access tokens are short-lived — **30 minutes** by default — and refresh automatically while you are active. The refresh window is **24 hours**, extended to **7 days** when you select **Remember me**. Refresh tokens rotate on every refresh and the previous one is revoked.
If a refresh fails — after long inactivity, a revoked token, or a server restart — you return to the sign-in screen with a `RefreshAccessTokenError` notice. Sign in again to continue.
## Sign Out
Open the user avatar in the top-right corner of any page and select **Sign out**. The session is cleared and you return to the sign-in form.
## Next Steps
<Columns cols={2}>
<Card title="Managing Your Team" icon="users" href="/user-guide/tutorials/prowler-for-msps-team">
Invite team members and assign roles.
</Card>
<Card title="Your Partner Organization" icon="briefcase" href="/user-guide/tutorials/prowler-for-msps-organization">
Lifecycle, settings, Partner Code and closing your organization.
</Card>
</Columns>
@@ -0,0 +1,85 @@
---
title: "Managing Your Team in Prowler for MSPs and MSSPs"
sidebarTitle: "Managing Your Team"
---
Each partner organization has its own team and its own role catalog. Administrators invite team members by email and assign each one a role that governs what they can do.
## Roles
Two roles ship with every partner organization:
* **Superadmin** — full account management. Invites members, adds and manages customers, edits branding and settings, and opens customer tenants.
* **Organization Admin** — manages customers and billing, and opens customer tenants. Cannot invite members, change organization settings, or add new customers.
Each role is a set of permission flags:
| Permission | What it allows | Superadmin | Organization Admin |
|---|---|:---:|:---:|
| **Manage members** | Invite, re-invite, disable, enable and remove team members | ✓ | |
| **Manage settings** | Edit the organization profile and branding | ✓ | |
| **Manage billing** | Manage customer plans | ✓ | ✓ |
| **Manage organizations** | Remove customers and edit their details | ✓ | ✓ |
| **Access tenants** | Open a customer's Prowler Cloud tenant | ✓ | ✓ |
<Note>
The Prowler Cloud-side permission level for a team member is provisioned automatically as **Manager** and is managed in Prowler Cloud, not here. There is no Cloud role to pick at invitation time.
</Note>
## Invite a Team Member
<Steps>
<Step title="Open Team">
Select **Team** in the sidebar. The entry only appears for roles with **Manage members**.
</Step>
<Step title="Send the invitation">
Click **Invite User**, enter the **Email**, pick a **User Role**, then click **Send Invite**. Each role option in the selector carries a one-line description of what it grants.
![Invite User dialog](/images/prowler-for-msps/invite-user-dialog.png)
</Step>
<Step title="Track the invitation">
The team table lists **Name**, **Email**, **Role**, **Status** and **User Event**. An invitation is **Pending**, **Accepted**, **Expired** or **Revoked**.
</Step>
</Steps>
The invitee receives an email with a one-time link, valid for **7 days**, that opens a public acceptance page. There they set their full name and a password, accept, and are sent to the sign-in screen.
An email address can hold only one pending invitation at a time.
## Re-Invite or Revoke
For a **Pending** or **Expired** invitation, **Re-invite** sends a fresh link and resets the expiry. **Revoke** invalidates the invitation immediately — the recipient can no longer accept it.
To re-issue an invitation that is still pending, use **Re-invite** rather than sending a second one.
## Disable, Enable or Remove a Member
Active members carry a **Disable** action. Disabling revokes access immediately but keeps the row in the table, flagged as disabled, so the audit trail survives.
A disabled member can be:
* **Enabled** — access is restored as it was.
* **Re-invited** — a fresh invitation brings them back as a new active member. The invite dialog opens pre-filled with their address and its title changes to **Re-invite user**.
<Warning>
The organization owner cannot be removed from the team while they hold ownership. Transfer ownership first.
</Warning>
## Notes
* The first administrator is created during sign-up and becomes the owner.
* An email address can hold only one active membership in a given partner organization.
* Permissions are scoped to one partner organization. A session for one organization carries no permissions in another.
## Next Steps
<Columns cols={2}>
<Card title="Onboarding Customers" icon="building" href="/user-guide/tutorials/prowler-for-msps-customers">
Add customers and open their Prowler Cloud tenants.
</Card>
<Card title="Billing and Customer Plans" icon="credit-card" href="/user-guide/tutorials/prowler-for-msps-billing">
Customer plans and revenue reporting.
</Card>
</Columns>