New: IT Support Role — Scoped Access for Your Helpdesk

[MoniWork]

We shipped a new sub-role for MonitorWorkspace organizations: IT Support.

It gives your helpdesk real monitoring visibility without the blast radius of full admin access.

---

What IT Support can see

Dashboard	Access
Health score	✓ Full access
Users & directory	✓ Full access
Gmail Compliance	✓ Full access
Security Events & Login Geography	✓ Full access
Connected Apps (OAuth grants)	✓ Full access
Delete Prep (suspended accounts only)	✓ Gated
Gmail inbox / Chat Viewer	✗ Blocked
Transfers (direct execution)	✗ Blocked — submit for owner approval
Billing / Subscription	✗ Blocked
Settings / Members	✗ Blocked

All blocked routes return 403 at the API level — not just hidden in the UI.

---

How to assign it

Owner account → Dashboard → Members → change the role dropdown for any existing member to IT Support. The user receives an email notification when their role changes.

---

Read more

We wrote four articles covering the feature in detail:

• How to Give Your Helpdesk the Right Level of Google Workspace Access — overview and role assignment
• Login Geography: The Signal That Gets Lost — how Security Events and Login Locations work for IT Support users
• The OAuth Grants Your Org Forgot About — the Connected Apps dashboard and OAuth attack surface
• The Suspension Gate: One Extra Safety Check — why IT Support can only run migrations on suspended accounts

---

Questions or feedback on how the role boundaries work? Drop them below.