MangoApps Console FAQ
Answers to common setup and operating questions about the MangoApps Console.
For what the Console is and how to set it up from scratch, see the
MangoApps Console Overview.
Setup
Do I need to create a separate account for each Console operator?
Yes. A Console operator account is separate from any tenant user account, with its own password, session and permissions. Create operators at Platform Settings → System Users. The email address must be on an approved staff domain, which by default means @mangoapps.com or @mangospring.com.
What role does a new operator get by default?
A new operator gets the Viewer role unless you pick another, and the account is active immediately. Viewer is the most restricted role and is mostly read-only. Only a SuperAdmin can give someone the SuperAdmin role.
Can an operator hold more than one role?
Yes. Tick several roles on the operator’s form, and they get every permission that any of those roles grants. The highest-ranked role is shown as their primary role. The ranking is SuperAdmin, then Admin, then Engineering, Product, Marketing, Sales, Finance, Legal and Support as equals, then Viewer.
What are the password rules for a Console operator?
A Console password must be at least 12 characters. That floor can be changed with the Set a platform runtime setting task on the Console’s Operations page. A password reset link stays valid for 6 hours, after which the operator must request a new one.
Permissions and access
Why can’t my operator see a particular sidebar section?
Each sidebar section needs a matching permission, such as View customers or View notification logs. If none of the operator’s roles grants it, the section is hidden. A SuperAdmin changes which permissions each role holds at Platform Settings → User Permissions. SuperAdmins pass every permission check.
Which actions are only available to a SuperAdmin?
Some actions need the SuperAdmin role itself, and no permission grant substitutes for it. They include:
- deleting a customer business
- editing User Permissions
- generating magic login links
- anything on Platform Maintenance, including forcing one tenant into maintenance
- deleting or impersonating another operator
- requiring, resetting or disabling two-factor authentication (2FA) for another operator
- turning on Console operational actions for an operator
What does the Console dashboard show each role?
Every signed-in operator can open the dashboard, but its sections depend on role:
- Sales — shown to Sales, Admin and SuperAdmin operators who also hold View demo requests.
- Marketing — shown to Marketing, Admin and SuperAdmin operators.
- Support — shown to Support, Admin and SuperAdmin operators.
- Platform health — shown to Engineering, Admin and SuperAdmin operators.
An operator with several roles sees every section any of their roles qualifies for.
What can the Sales role do with Demo Requests and My Leads?
Sales operators can view their leads, work them and delete them, but cannot import leads. Demo Requests (the sales-leads list) has its own four permissions: View demo requests, Import demo requests, Work demo requests and Delete demo requests. By default, SuperAdmin, Admin, Product and Marketing hold all four, and Sales holds every one except import. An operator whose roles include Sales but not SuperAdmin, Admin or Marketing sees only the leads assigned to them. Their list is titled My Leads, and their Sales dashboard counts only those leads.
Day-to-day
How do I require two-factor authentication for Console operators?
There are two ways, and both give the operator a setup window before they are signed out:
- One operator — a SuperAdmin opens the operator’s menu at Platform Settings → System Users and chooses Require 2FA.
- Whole roles — run the Set Console 2FA policy task on the Operations page. You name the roles that must enrol and how many hours they get.
The setup window is 24 hours unless the policy sets a longer one. For operators covered by the policy, it starts at their next sign-in, unless you choose to start it when you run the task.
How do I help an operator who lost their authenticator app and backup codes?
A SuperAdmin chooses Disable 2FA from that operator’s menu at Platform Settings → System Users. This clears their authenticator link and backup codes, and the operator is emailed that it happened. If 2FA is still required for them, a fresh setup window starts at the same moment, so they are not signed out for a deadline that passed before they first enrolled. Each operator gets 10 backup codes when they set up 2FA, and each code works once.
How long does a Console session last?
A Console session ends after 8 hours without activity. Whatever the activity, the operator is signed out 24 hours after signing in. There is no “remember me” option.
Where do I land after signing in from a link in an email?
You land on the page the link pointed to, not the dashboard. The Console remembers the page when it asks you to sign in or when your session has expired. This works for password, 2FA, sign-in-link and Google sign-in. If you are still being asked to set up 2FA, you go to that step first.
Can operators sign in with Google?
Yes, from @mangoapps.com or @mangospring.com Google accounts only. Google sign-in never creates an account. The operator must already have a Console account with the same email address.
How do I pause all outbound email across every tenant?
Open /system_settings/email_settings on the Console and use Pause Email Delivery on the Global Email Delivery card. While delivery is paused, the Email Configuration card at Platform Settings → System Settings also links there with Manage. You must give a reason of up to 500 characters and choose how long: 15 minutes, 1 hour, 4 hours (the default), 24 hours or indefinitely. One-time passcodes, password resets and verification codes are still delivered. The switch needs the Edit email settings permission.
What is the difference between suspending a business and putting it in maintenance?
Suspension is a lasting account state: the tenant’s users are refused until an operator reactivates it from the customer record. Suspending and reactivating need the Suspend customers permission. Maintenance is a temporary window that can block web, API, integrations and mobile access. A window forced from the Console cannot be bypassed or cleared by the tenant’s own admins. Only a SuperAdmin can force maintenance or turn on platform-wide maintenance.
Can the Console AI sidebar take actions, or only answer questions?
It answers questions for every active operator, and takes actions only for operators who have been set up for it. The default Console Operations assistant is read-only. Confirmed actions, such as changing a tenant’s app access or retrying a failed background job, need two things:
- a SuperAdmin has switched on Console operational actions on the operator’s record (off by default)
- the operator holds Manage customer access, Manage background jobs, View diagnostics, View notification logs or Suspend customers
When something looks wrong
“I’m locked out of the Console after my 2FA setup period expired”
A SuperAdmin must help, because you cannot fix this yourself. They can choose Reset 2FA Deadline for a new setup window, or Make 2FA Optional if your role is not covered by the platform policy. Until then the sign-in page shows “Your 2FA setup period has expired. Please contact a system administrator.”
“I deactivated an operator but they’re still logged in”
They are not, even if their page is still open. The Console checks that the operator is active on every request. Their next click or refresh signs them out and returns them to the sign-in page.
“I’m in Sales and I can’t see a colleague’s lead or import leads”
That is expected for Sales operators. If your roles include Sales but not SuperAdmin, Admin or Marketing, you see only the leads assigned to you. Opening another rep’s lead returns “Access denied.” Bulk actions change only your own leads. Importing leads needs Import demo requests, which the Sales role does not hold by default.
Licensing and limits
What limits and timeouts should I know about?
| Limit | Value |
|---|---|
| Idle session timeout | 8 hours |
| Maximum session length | 24 hours |
| Minimum operator password | 12 characters (adjustable) |
| Password reset link | 6 hours |
| 2FA setup window | 24 hours by default |
| Backup codes | 10, each single-use |
| Console AI message length | 10,000 characters |
| Console AI rate | 15 messages per minute per operator |
| Email pause reason | 500 characters |
| Authentication Events CSV export | 50,000 rows |
The Authentication Events export covers every tenant, so narrow it with the page’s filters before exporting.
More help
- MangoApps Console Overview
- Ask AI — the Console AI sidebar answers questions about live platform state on every Console page.