How to Add Techs, Set Roles, and Require SSO and MFA

What's in the demo

• Settings → Users: each row shows role, status and MFA status. Elena Brooks and Tyler Nguyen (Partner Technician) are Enrolled; Sam Rivera (Partner Billing) is Not required
• Settings → Roles: built-in system roles such as Partner Admin and Partner Technician, which can't be edited. Partner Technician's permission matrix allows Scripts Execute and Tickets Write but no Invoices access
• Clone Partner Technician as "Help Desk (Tier 1)" ("Tickets and alerts. No scripts yet.") and untick Scripts Execute
• Invite user: Chris Patel, role Help Desk (Tier 1), Access level Specific organizations with Acme Manufacturing and Corestone Fabrication. Email isn't configured on the demo server, so the toast offers the invite link to copy; Chris shows as Invited
• Reset MFA on Tyler Nguyen's row: his second factor is cleared, he is signed out everywhere, and his MFA status changes from Enrolled to Not required
• Settings → Partner → Security: the "Require MFA for all users" checkbox
• Create Role with Scope "Organization: Acme Manufacturing", named "Acme IT (co-managed)", with Devices, Alerts and Tickets permissions ticked
• Settings → Single Sign-On → Add provider: Applies to "This organization", provider name "Acme Entra ID", preset Azure AD / Entra ID, a placeholder Microsoft issuer URL, default role Acme IT (co-managed)
• Auto-provision users on, allowed email domain acmemfg.example, and Enforce SSO-only login with its warning that password sign-in will be disabled. The provider is not saved

Questions this video answers

How do I give a new technician limited permissions in Breeze RMM?

Built-in roles can't be edited, so go to Settings → Roles, click Clone on a role such as Partner Technician, give it a name and untick what the tech shouldn't do. Then choose that role when you invite them from Settings → Users → Invite user.

Can a technician see only some of my clients?

Yes. When you invite or edit a partner user, set Access level to "Specific organizations" and pick the clients. They stay your own staff, with a shorter client list.

How do I give a client's own IT person access to only their company?

Create a role with Scope set to that organization under Settings → Roles. Then add an SSO provider for that organization under Settings → Single Sign-On, with that role as the default for new users and Auto-provision on. Their staff get an account inside that one organization the first time they sign in, and Allowed email domains keeps it to the client's addresses.

How do I require MFA for every user in Breeze RMM?

Tick "Require MFA for all users" under Settings → Partner → Security and save. After that, anyone without a second factor, you included, must set one up before Breeze lets them do anything else.

A technician lost their phone. How do I reset their MFA?

Go to Settings → Users and click Reset MFA on their row. It removes their second factor and signs them out of every session, so they sign in next with just their password until they enroll again.