MSP Workspaces¶
Overview¶
MSP Workspaces let one CloudVerse organization subdivide the platform into a hierarchy of isolated workspaces. A managed service provider, reseller, or any organization with distinct downstream customers can give each of them their own scoped cost view, apply a markup on the cloud spend it passes down, and still keep full visibility over the whole tree.
The organization that owns the CloudVerse subscription keeps the complete FinOps product. Everything beneath it is a workspace: a bounded slice of the platform with its own users, its own allocated cloud accounts, its own cost data, and optionally its own markup rate.
Who can use this¶
MSP Root Admin— full platform access and management of the entire workspace tree.MSP Managed Workspace Manager— manages one workspace and everything below it.MSP Customer Dashboard User— views the cost dashboard for a single workspace.
Availability depends on tenant rollout. If the Workspaces tab or workspace actions are missing, confirm your role and that MSP Workspaces is enabled for your tenant.
How the hierarchy works¶
Workspaces form a tree. Each workspace sees itself and everything below it, and never sees its parent or its siblings.
Root organization
└── Managed workspace e.g. a reseller customer
├── Normal workspace e.g. that customer's production team
└── Normal workspace e.g. that customer's development team
Two rules hold at every level:
- Allocation flows downward only. A workspace can allocate cloud accounts only to its own children, and only accounts it already holds. It can never allocate to a sibling or to its parent.
- Visibility flows downward only. A parent sees everything in its own subtree. A child never sees its parent or a sibling.
Workspace types¶
You choose one of two types when creating a workspace. This choice determines whether that workspace can build a hierarchy beneath it.
| Type | Label in the UI | What it can do |
|---|---|---|
| Managed | Managed (can own children) |
Creates child workspaces, allocates accounts downward, invites its own users, and sets billing rules for the workspaces below it. |
| Normal | Normal (leaf) |
Views cost data for its own allocated accounts. Cannot create children or allocate accounts. |
Choose Managed if the workspace will ever onboard its own users or sub-workspaces. Choose Normal if it is the end of the line.
There is no fixed depth limit. A Managed workspace can sit under another Managed workspace as deep as your business structure requires.
The root workspace¶
The root workspace is not a special object type. It is an ordinary Managed workspace at the top of the tree, owned directly by your organization rather than by another workspace. An administrator with organization-level admin permission creates it through the standard workspace flow.
Core concepts¶
| Concept | Meaning |
|---|---|
| Workspace | A bounded access and cost boundary within a tenant. |
| Account allocation | The explicit assignment of connected cloud accounts to a workspace. A workspace sees only the cost of the accounts allocated to it. |
| Billing rule | A markup rate on the edge between a parent workspace and one specific child. |
| Preview | A root administrator viewing a workspace's dashboard without changing their own identity. |
| Workspace switcher | A control that moves your working context between your own direct child workspaces. |
Quick links¶
- Set up a workspace hierarchy — create workspaces, allocate accounts, invite users, set branding.
- Markup and billing rules — apply and interpret markup between workspaces.
- Switching context and previewing — move between workspaces and inspect a customer's view.
Expected result¶
Each workspace's users sign in and see a cost dashboard scoped to exactly the cloud accounts allocated to them, priced at the rate their parent charges them, with no visibility into any other workspace.
Notes and limitations¶
- A workspace sees no cost data until cloud accounts are allocated to it.
- One cloud account cannot be allocated to two sibling workspaces at the same time.
- A workspace never sees the markup applied to itself.
- Cost Explorer and the cost dashboard are the primary workspace-aware surfaces. Other modules become workspace-aware on a rolling basis.