What WOSP does for your Google Workspace tenants
A partner portal for MSPs: multi-tenant admin, security, reporting, and client access in one place. Feature list below; detail lives in the docs (opens in a new tab).
No annual contracts. Month to month.
The reason MSPs switch
Work the Admin Console has no answer for
Google built the Admin Console for one org. These are the multi-tenant gaps.
| Feature | What it does |
|---|---|
| Bulk actions | Multi-select on users, groups, org units, OAuth apps, devices, alerts, and Chat spaces. Destructive actions confirm first and report per-item results. |
| Scheduled user creation | Build the hire now; WOSP creates the account on the start date with org unit, profile fields, and welcome email. |
| Scheduled offboarding | Queue a last-day job: reset, revoke sessions, transfer Drive, reclaim license, then archive or delete. |
| Google or Entra ID sign-in | Google Sign-In or Entra SSO for your techs, with a wizard that creates the Entra app registration. |
| MSP technician accounts | Declare your shared admin username once; exclude it from inactive-user and 2SV findings across tenants. |
| Export anything | CSV from every list: users, groups, devices, licenses, findings, audit rows. |
Access
Who can see what, down to the tenant
| Feature | What it does |
|---|---|
| Five fixed roles | Platform admin, MSP technician, MSP read only, client user, and client read only. Read-only is enforced on the API. |
| Client self-service | Scoped logins for client contacts on their tenant, read-only or with writes. |
| Per-tenant scoping | Each assignment is all tenants, include list, or exclude list. Hide your own partner tenant from techs scoped to all. |
| Break-glass access | Explicit assignment first, then an allowlist. Empty allowlist denies; no domain-wide admin fallback. |
Security
Posture you set once and check everywhere
| Feature | What it does |
|---|---|
| Policies and standards | Define expected posture once; WOSP checks every tenant for drift and guides remediation. Auto-fix only where Google allows the write. |
| Security findings | Recommended state, current state, why it matters, and a link to fix it in the Admin Console. |
| Compromise remediation | Gather BEC indicators, then reset, revoke sessions, and clear forwarding, filters, and delegation in one action. |
| OAuth app control | Inventory authorized apps, bulk revoke, and triage user requests for unapproved apps. |
| Sharing audits | Shared drives with external members and files exposed outside the org, per tenant. |
| Inbound SAML review | SAML profiles and recent SSO audit events per tenant. |
Visibility
Reporting and alerts
| Feature | What it does |
|---|---|
| Multi-tenant dashboard | User counts, storage, security signals, and prioritized issues with trend charts across clients. |
| Branded PDF reports | Client-ready executive PDFs with your logo: posture, findings, licensing, storage, and devices. |
| PSA alerting | Collection failures, findings, and Google alerts open PSA tickets, once per cooldown window. |
| Audit-log alert rules | Opt in to Workspace audit events and Google Alert Center items in one pipeline. |
| Automated collection | Scheduled snapshots, job monitoring, and per-tenant collection history. |
| Platform audit log | Every team sign-in and mutating action, with tenant and change detail. |
Day-to-day admin
The rest of the console, multi-tenant
| Feature | What it does |
|---|---|
| Users, groups, org units | Provision, edit, search, and move users; manage domains, admin roles, and calendar resources. |
| Licensing and storage | Assign licenses by SKU, find reclaimable seats, and review Drive and shared drive usage. |
| Devices and browsers | Chrome OS, mobile, and Chrome browser inventory with approve, block, wipe, and deprovision actions. |
| Gmail settings | Per-user Gmail, delegation, forwarding, and compliance settings across tenants. |
| Adoption metrics | Meet, Calendar, Drive, Chat, Classroom, Docs, and Sites usage per tenant. |
| Chat and Classroom | Chat space inventory and Classroom course administration. |
Running it
One instance per MSP
| Feature | What it does |
|---|---|
| Isolated instance | Your tenants, settings, and history are never pooled with another MSP. |
| Tenant onboarding wizard | Walks GCP project, OAuth client, and API enablement for a new client tenant. |
| White-label branding | Your logo and colors on login and PDF reports, with MSP and tenant variables in client copy. |
| Backup and migration | Export instance config and seed a new instance from a settings pack. |
| REST API | OpenAPI automation with scoped keys: role, tenant scope, expiry, and write toggle. |
| MCP server | Claude and Cursor access with the same roles and scoping; writes gated by platform admin. |
Where Google draws the line. Google's admin APIs are narrower than Microsoft Graph, especially for org-wide tenant settings. WOSP documents every one of those gaps instead of pretending they are not there, and ships coverage as soon as Google makes an API usable.
Read the docs (opens in a new tab)