Enable partner access

Partner-managed Afi customers can enable partner access to allow partner administrators to access and manage their backups. The access is granted automatically when a partner administrator adds a customer account directly from the partner control panel by using Google Workspace or Microsoft 365 tenant administrator credentials. In other cases, when a partner adds a customer by ID or when a customer creates an account via a partner onboarding link, the access is disabled by default and should be granted explicitly by a customer account administrator on the Configuration → Partner Access tab.

The Partner Access tab is displayed only for partner-managed accounts. Therefore, if a customer does not see this tab, they should refresh the page. The tab will appear once the application receives new account settings.

After access is granted, partner account administrators will be able to configure and manage the customer's backup account.

Partner access permissions explained

This section explains the available partner access permissions and what level of access each of them provides.

Administration & configuration

Permission	Description
Browse resources and tasks	Partner account administrators can go inside the customer account in the Afi partner portal, can see a list of resources and their protection statuses, check backup activity, but can't manage or access the backups without additional permissions.
Manage access	Partner account administrators can manage access to the customer account and tenants inside the account. Access settings are configurable on per-account level on the Configuration → Admins and at the tenant level on the Service → Settings → Access groups tabs. When configuring access settings for the customer account or its tenants, please make sure that the corresponding customer account context is selected in the customer selection dropdown on top of the screen.
Manage organization settings	Partner account administrators can update organization settings for the customer account. Settings include customer organization name, contact person, and permission to share anonymous diagnostics data with Afi.
Manage organization access policies	Partner account administrators can update organization access policies for the customer account. Access policies available for configuration include organization access rules based on IP address, country, and identity provider, as well as lockdown mode for sensitive operations restriction.
Add new data sources	Partner account administrators can add new data sources (tenants) under the customer account.
Manage data source settings	Partner account administrators can update data source-level settings (for example, enable extended self-service access for Shared drives or SharePoint sites in the customer's tenants). Please note that this setting alone doesn't grant access to manage SLA policies, access permissions or other objects/rules inside the customer's tenants.
Manage apps	Partner account administrators can enable public API access in the customer account and manage API keys.

Monitoring

Permission	Description
View audit	Partner account administrators are able to view audit log events for the customer account (history of export and recovery operations, system settings changes, etc.).
View alerts	Partner account administrators are able to view alerts for the customer account (for example, alerts regarding possible ransomware incidents).
Manage notifications	Partner account administrators can configure service notification recipients for the customer account on the Configuration → Notifications tab.

Data protection management

Permission	Description
Configure SLA	Partner account administrators can configure backup SLA policies for the customer account on the Service → Settings → SLA tab.
Assign SLA and initiate backup	Partner account administrators are able to protect resources (User, Shared Drive, SharePoint site, Team, etc.) in the customer's tenants and manage auto-protection configuration.
Manage secrets	Partner account administrators can configure custom encryption keys for backups in the customer's tenants on the Service → Settings → Secrets tab. Should be enabled together with the Configure SLA permission.
Delete backups	Partner account administrators can schedule a delayed deletion (deletion in 7 days) for backups in the customer account.
Manage data deletion requests	Partner account administrators can submit, review, approve, decline, and cancel data deletion requests for backups in the customer account on the Service → Settings → Data deletion tab.

Data access

Permission	Description
Browse backup data	Partner account administrators are able to browse backup data for all backups in the customer account, but can't export the data or preview email/chat messages without additional permissions.
Preview content	Partner account administrators are able to see content for backed up items (emails, chat messages, virtual machine volumes, database tables, etc.) in all backups in the customer account.

Data recovery and export

Permission	Description
In-place recovery	Partner account administrators can trigger a recovery operation that restores selected items (for example, emails/files) in a backup at the same paths where they were during a backup. This recovery mode should be used with caution as it will overwrite files if they have been changed since the point in time when the backup was done.
Recovery to another folder	Partner account administrators are able to recover backup data to a separate folder/location inside a restore destination resource. This is the safest recovery option which guarantees that no data will be accidentally overwritten.
Recovery to another resource	Partner account administrators are able to recover backup data in another resource. This option should be enabled together with one of the following options - Recovery to another folder or In-place recovery.
Data export	Partner account administrators are able to download backup data from all backups in the customer account.