--- title: "Client portal" description: "A branded portal where your clients see invoices, pay, approve work, raise tickets, report starters and leavers, see devices and reports, and connect remotely." url: "https://support.outpostplatform.com/client-portal/" product: "depot" type: "concept" status: "draft" ai_summary: "MSP plan. A branded client portal at /portal or a custom domain, off per client until turned on. One account can belong to several clients. Password plus a required second factor, passkeys, or Entra or Google SSO. Portal roles are separate from console roles and limited by a per-client ceiling. Remote access is off until granted." availability: plans: ["msp"] permission: "clientportal:read" preview: false source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/client-portal/index.md" license: "CC BY 4.0" --- # Client portal The client portal is a website your clients sign in to. It shows them their invoices and lets them pay, approve quotes and other work, raise and follow tickets, ask you to set up or remove a member of staff, see their devices and reports, and connect to their own computers when you allow it. It carries your branding, not Outpost's. This page explains how the portal works and what you decide for each client. There is a separate guide for the people at your clients who use the portal, which you can send them: [Using the client portal](/portal-guide/). ## How it works The portal is part of your Depot, so it needs nothing installed. - **Address.** The portal is at `https:///portal`, where `` is the address you sign in to the console at. You can serve it on your own domain instead, for every client or for one. See [Serve the portal on your own domain](/client-portal/custom-domains/). - **Off until you turn it on.** The portal is off for every client until you turn it on for that client. Portal users cost nothing and have no limit. - **Separate from the console.** A portal account can never sign in to the console, and a console account cannot sign in to the portal. Portal roles hold portal permissions only, so nothing you grant in the portal reaches your console. - **One account, several organizations.** A person can be a member of more than one of your clients, for example a bookkeeper who works for two. They sign in once and switch between organizations. What they can do is set separately in each. - **Access checked on every request.** When you suspend or offboard a portal user, the next thing they do in the portal is refused, on every Depot server, and their remote sessions end. ## Signing in Every portal user signs in with a password and a second factor, a passkey, or single sign-on: - **Password and a second factor.** A second factor is required for everyone. After their first sign-in, a user sets up a passkey or an authenticator app before they can do anything else, and saves recovery codes. - **Passkeys.** A user can sign in with a passkey alone. - **Single sign-on.** For clients on Microsoft Entra ID, Google Workspace, or Okta, people sign in with their work account. See [Set up single sign-on and directory sync](/client-portal/sso/). Single sign-on never creates a portal user. Only people you, or the client's owners, have invited can sign in. Pages that handle money, people, remote access, and the account's own sign-in settings ask the user to confirm who they are again after 15 minutes without activity, as PCI DSS 8.2.8 requires. Sessions also end after a set time idle and a set length. See [Portal defaults](/client-portal/defaults/). ## What clients can do What each portal user sees depends on their roles. The portal uses your client's words, not yours: **Devices** rather than endpoints, **Activity log** rather than audit log. | Portal page | What it does | Documented in | | --- | --- | --- | | **Billing**, **Invoices**, **Next bill**, **Payments** | Invoices, paying, receipts, and an estimate of the next bill | [Client payments](/client-payments/) | | **Payment methods**, **Autopay** | Saved cards and bank accounts, and automatic payment | [Set up autopay for a client](/client-payments/autopay/) | | **Approvals**, **Quotes**, **Projects** | One inbox for everything waiting on the client's decision, quote signing, and milestone sign-off | [Ask a client to approve something](/client-portal/approvals/) | | **Tickets** | Raise tickets, reply, and attach files | [Service desk](/service-desk/) | | **Starters and leavers** | Ask you to set up or remove a member of staff | [Handle starter and leaver requests](/client-portal/requests/) | | **Devices**, **Reports** | The client's devices with warranty and age, and their reports, also by email on a schedule | [Using the client portal](/portal-guide/) | | **Remote access** | Connect to their own computers, within limits you set | [Let clients use remote access](/client-portal/remote-access/) | | **People**, **Roles**, **Groups** | Client owners manage their own people, within limits you set | [Set portal roles, groups, and the permission ceiling](/client-portal/roles-and-ceiling/) | | **Activity log** | What your technicians and the client's people did, with an export that can be verified | [Name technicians in the activity log](/client-portal/activity-log/) | ## What you decide for each client | Decision | Where | | --- | --- | | Whether the portal is on, and who is invited | The client's **Client portal** tab, **Overview** and **Users**. See [Turn on the portal for a client](/client-portal/turn-on/). | | The most any portal user at the client can do | **Permission ceiling**. See [Set portal roles, groups, and the permission ceiling](/client-portal/roles-and-ceiling/). | | Whether portal users can use remote access, and how | **Remote access**. See [Let clients use remote access](/client-portal/remote-access/). | | Single sign-on and directory sync | **SSO and directory**. See [Set up single sign-on and directory sync](/client-portal/sso/). | | A different look from your other clients | **Branding**. See [Brand the client portal](/client-portal/branding/). | | Whether technicians appear by name | **Audit naming**. See [Name technicians in the activity log](/client-portal/activity-log/). | Settings that apply to every client are on **Settings** > **Client portal**: branding, custom domains, SSO apps, Microsoft Teams, and defaults. ## Who can do what | Task | Permission | | --- | --- | | See a client's portal settings, users, requests, and approvals | `clientportal:read` | | Turn the portal on or off, set the ceiling, SSO, audit naming, Teams, and defaults | `clientportal:manage` | | Invite, suspend, and offboard portal users; edit roles and groups; work requests | `clientportal:users` | | Set the remote access ceiling and grant remote access | `clientportal:remote` | | Edit branding | `clientportal:branding` | | Add and remove custom domains | `clientportal:domains` | Every role that holds `client:manage` is given all six. See [Client portal permissions](/client-portal/permissions/). ## Related - [Turn on the portal for a client](/client-portal/turn-on/) - [Using the client portal](/portal-guide/) - [Client payments](/client-payments/) - [Outpost for MSPs](/msp/)