Finish setting up a client: contract terms, co-managed access, and vault codes
Past the New Client form, on a client that already has a plan: set its contract terms, turn on Co-Managed IT, cancel and reactivate a subscription, add a one-time-code vault entry, and find where a company-wide document actually lives.
What you will have
- Know that a client's Microsoft tenant ID is never typed in by hand.
- Turn on Co-Managed IT for a client and know which roles that actually hands access to.
- Read a subscription's Contract Terms: what No Commit means and what Bill in arrears changes.
- Cancel a subscription and reactivate it, and know exactly what that does to billing.
- Add a one-time-code (TOTP) secret to a vault entry and generate a live code from it.
- Write a document once on your own company record and have it turn up in search from every client.
- Notice a script reference on an onboarding step, and know what it is for.
Why it works this way
Reactivating a cancelled subscription does not pick up where it left off. Billing resumes with the period due today, and any month the subscription sat cancelled stays unbilled unless you charge it by hand with Backfill - this is why the Billing tab shows an "N unbilled periods" chip after a reactivation instead of quietly back-billing everything on its own.
A document written on your own company's client record is not filed under any one client. It counts for every client at once, which is why it never appears in that client's own Knowledge Base or Procedures list - only in search.
Steps
Open Clients, click New Client, and look at the Identity Provider field.
There is no field anywhere on this form for a Microsoft tenant ID. Identity Provider only picks which directory this client will eventually connect - Microsoft fills the tenant ID in on its own, later, once that client's admin grants consent.
Note: The hand-entry boxes for a tenant ID were taken out. It is read-only once Microsoft sets it.Open Clients, click New Client, and look at the Identity Provider field. Open the client, click Edit, go to Settings, and turn on Co-Managed IT.
With it on, this client's own IT Admin and Primary Contact (or Owner) users can claim an unassigned ticket and log time on it inside their own company. A banner warns when no user on the client yet holds one of those roles, since the feature would have no one to use it.
Open the client, click Edit, go to Settings, and turn on Co-Managed IT. On the Billing tab, click Add Core to give the client a plan.
Add Core stays on the panel even after a plan is assigned, so you can see it here beside the one core plan this client already carries.
On the Billing tab, click Add Core to give the client a plan. Open Edit subscription and find No Commit under Contract Terms.
No Commit means the subscription bills at its selected frequency until someone cancels it - no contract start or end date, no renewal term, no annual increase. It covers month-to-month and annual no-commit arrangements alike.
Open Edit subscription and find No Commit under Contract Terms. On the same screen, find Bill in arrears.
Bill in arrears changes WHEN the customer is charged for a period, never how much. Off, the default, charges in advance at the start of the period. On charges in arrears, after the period ends.
On the same screen, find Bill in arrears. Cancel the subscription from its ⋮ menu.
The confirm dialog says exactly what cancelling does: future billing runs stop charging it, invoices already generated are kept, and reactivating later resumes billing with the period due that day.
Cancel the subscription from its ⋮ menu. Open the Core - Inactive section and reactivate it.
The Reactivate subscription dialog states the same rule from the other side: future billing resumes charging it, starting with the period due today, and any month it sat cancelled stays unbilled unless you charge it with Backfill.
Open the Core - Inactive section and reactivate it. See the subscription back under Core, Active, with an unbilled period.
The subscription reads Active again next to a "1 unbilled period" chip, exactly the month it spent cancelled - it was not silently billed, and it was not skipped for good either.
See the subscription back under Core, Active, with an unbilled period. Open Documentation > Password Vault, edit an entry, and find TOTP Secret.
TOTP Secret takes the same Base32 text most authenticator apps show under their own QR code. It is stored masked, the same way the Password field is.
Open Documentation > Password Vault, edit an entry, and find TOTP Secret. Back on the vault list, generate a code from that entry.
The shield icon on the row turns the stored secret into a live six-digit code with its own countdown, the same as the Generate control on the entry's own page.
Back on the vault list, generate a code from that entry. Open your own company's client record and check its Knowledge Base.
Every company has its own client card under Clients, alongside real clients. Anything filed in its Knowledge Base, Procedures, or a document section counts for every client - this one already carries several approved articles.
Open your own company's client record and check its Knowledge Base. From any other client, search for that same article.
That client's own Knowledge Base tab still reads zero entries, but the header search still finds the company-wide article, labelled with the company's own name so it is clear where it actually lives.
From any other client, search for that same article. Start onboarding and look for a script reference under a step.
A script reference is an optional pointer, a name or link, to a deploy script a technician runs by hand before checking that step done. The portal never runs the script itself; two of the default template's steps already carry one.
Start onboarding and look for a script reference under a step.
If it did not work
- If Co-Managed IT will not turn on with a warning still showing, add a user in the IT Admin, Primary Contact, or Owner role first - the feature otherwise has no one to use it.
- If a subscription's Contract Terms panel will not open, use Edit subscription from the Core section, not the plain plan name link.
- If a generated TOTP code never appears, check the secret was saved as plain Base32 text, not a full otpauth:// URL.
Questions this page answers
Where does a client's Microsoft tenant ID come from?
You do not type it in. The hand entry boxes were taken out, and the field is read only now. Microsoft hands the tenant ID back when the client's admin grants consent, and the portal saves it then. You can start that from the Microsoft icon on the clients list, from the client's Integrations tab, or from a consent link you send them. The client can also start it. An owner, a primary contact or an IT admin sees a consent banner in their own portal. Once the ID is stored, a Disconnect Tenant action shows on the client edit form.
Which client roles get co-managed access?
IT Admin and Primary Contact, and only while that client has Co-Managed IT turned on. Those two can claim an unassigned ticket for themselves and log time against it. They cannot write internal notes. Notes are staff only and clients never see them. They also cannot hand a ticket to one of your techs. Claiming is the only assigning they do. Billing and User get none of this. They work their own tickets and nothing else.
What does "No Commit" mean on a subscription?
No commitment term: the subscription bills at the selected frequency until it is cancelled, with no contract start/end dates, renewal term, or annual increase. It covers both month-to-month and annual no-commit arrangements. Turning it on clears the contract-term fields; turn it off to set explicit contract dates.
What does "Bill in arrears" change?
It changes WHEN the customer is charged for a period, never how much. Off (the default): the customer is charged in advance, at the start of the period. On: the customer is charged in arrears, after the period ends, for usage already delivered. Set it per subscription in the client's Contract Terms.
What happens when I reactivate a cancelled subscription, or resume a paused one?
Billing resumes with the period due TODAY - not from where it left off. The confirm dialog does not report a count of skipped periods; instead, the subscription's row on the Billing tab shows an "N unbilled periods" badge for every month it sat cancelled or paused, and clicking it (or Run Backfill from the subscription's own menu) opens a picker that previews exactly those months and lets you generate catch-up invoices for the ones you choose. Nothing is billed for the gap automatically.
How do one time codes work in the vault?
Store the code secret on the vault entry. It has to be Base32 text. Most authenticator apps show that text under their QR code. On the vault list, use the shield on the row to make a code. On the entry page, use the Generate Code button instead. There you also get a ring that counts down. A code lasts 30 seconds and then a new one takes over. The code panel closes itself after 5 minutes. The copy button puts the code on your clipboard. The secret is encrypted, with its own key parts.
How do I write a doc that counts for every client?
File it on your own company record. Your company has a client card of its own under Clients. Anything you put in Knowledge Base, Procedures or a document section there counts for every client. It turns up in search on any client's ticket, and you can link it to any ticket. Passwords, domains, network gear and expiry rows do not work this way. Those stay tied to one client. Clients never see what sits on your own record.
What is the script reference on a step?
A step can carry an optional script reference - the name or link of a deploy script a technician runs manually, then checks the step done. It is a pointer for the tech; the portal does not run the script for you.
Was this helpful?