MangoApps Console

MangoApps Console

1. What it is

The MangoApps Console is the platform-wide administration portal for managing tenants (customer businesses), billing, app licensing, AI configuration, system operations, and compliance. It runs on its own subdomain — separate from any tenant — and is used by the team that operates the platform, not by tenant admins or end users.

• Access: The Console lives at console-{env}.workforce.mangoapps.com (e.g. console.workforce.mangoapps.com in production). The legacy sysadmin.* hostname redirects here.
• What it is not: The Console is not a tenant admin panel. Tenant admins manage their own business at Admin → within their subdomain. The Console manages the platform across all tenants.

2. Standing it up

Console operator accounts are entirely separate from tenant user accounts. By default a SuperAdmin or an Admin creates operators and assigns their roles.

1. Sign in at the Console URL with email and password, or with Sign in with Google. Google sign-in works only for a staff account that already exists; it never creates one.
2. Go to Platform Settings → System Users to create an operator. Each needs a first name, last name, a unique email and a password of at least 12 characters. The email must be on an approved staff domain.
3. Assign one or more roles. Roles decide which sidebar sections and pages the operator can open. The ten roles are: SuperAdmin, Admin, Engineering, Product, Marketing, Sales, Finance, Legal, Support, Viewer.
4. Optionally tick Require Two-Factor Authentication. An operator who is required to use it and has not enrolled gets 24 hours to enrol before they are signed out, or the grace period the Console 2FA policy sets.
5. Confirm the operator can sign in and sees the sidebar sections their roles allow.

A new operator defaults to the Viewer role and is active immediately. SuperAdmin is the only role that implicitly holds every permission. Every other role sees only the pages its permissions cover.

An Admin cannot change the email, password, active status or 2FA requirement of a SuperAdmin; only another SuperAdmin can.

If an operator opens a Console link while signed out — for example from an alert email — sign-in brings them back to that page instead of the dashboard. This works for password, two-factor, SSO-link and Google sign-in.

3. How it fits together

Operators and roles

Console operators are separate from tenant users. An operator can hold several roles at once. The highest-priority role becomes their primary role. From highest to lowest: SuperAdmin (1), Admin (2), then Engineering, Product, Marketing, Sales, Finance, Legal and Support (all 3), and Viewer (4).

For example, an operator holding Sales and Viewer has Sales as their primary role, because level 3 outranks level 4.

SuperAdmin holders pass every permission check. Every other role is resolved through role-permission mappings. Each role is granted a set of named permissions (for example View customers or Manage pricing), and every Console page requires one of them.

Sales operators and their leads

Demo Requests (the Console’s list of sales leads) has its own four permissions: View demo requests, Import demo requests, Work demo requests (assign, change stage and follow-up, mark spam, re-sync to HubSpot) and Delete demo requests.

By default the Sales role holds view, work and delete, but not import. Admin, Product and Marketing hold all four.

A Sales-only operator is one who holds Sales and none of SuperAdmin, Admin or Marketing. Their access is limited to the leads assigned to them:

• The lead list is titled My Leads and shows only their own leads.
• Opening, assigning, marking spam or deleting another rep’s lead is refused.

The Import button appears only for roles with Import demo requests. Links to lead routing rules appear only for roles that can edit Marketing pages.

Worked example: a rep holding only Sales opens the lead list and sees My Leads, containing just the leads assigned to them, with no Import button. Give the same person the Marketing role and the page becomes Demo Requests, listing every lead, with Import available.

Permission categories

Permissions are organized into categories that correspond to sidebar groups. The main categories: Customers, Billing, Apps & Licensing, AI & Automation, Operations, System Settings, Users, API Tokens, Issue Reports, Legal & Compliance, Training, Knowledge Base, Company Store, and several others. Each category has view, create, edit, delete, and specialized entries (for example Manage pricing under Billing, or Manage OpenAI keys under AI & Automation).

Only a SuperAdmin can edit role-permission mappings (Platform Settings → User Permissions).

Two-factor authentication

Console 2FA uses TOTP (time-based one-time passwords). Once enrolled, the operator enters a code after their password. Ten backup codes are generated at setup and encrypted at rest.

2FA can be required in two ways. An operator’s own Require Two-Factor Authentication box covers one person. The Set Console 2FA policy task on System Operations → Operations covers whole roles and sets their grace period. Either way, the grace period is 24 hours unless the policy sets a different one. After it, sign-in is refused until an administrator helps the operator enrol.

Dashboard

The Console dashboard is role-aware. It shows different widget groups depending on the operator’s roles:

• Sales (Sales, SuperAdmin, Admin, and only with View demo requests): overdue follow-ups, active leads, closed-won this month and the lead pipeline. A Sales-only operator’s counts cover their own leads only.
• Marketing (Marketing, SuperAdmin, Admin): AI conversations, demo requests, assessments
• Support (Support, SuperAdmin, Admin): new/active/critical cases, personal case count
• Platform (SuperAdmin, Admin, Engineering): total/active businesses, user counts, 2FA adoption, failed logins

Operators with multiple roles see the union of all applicable widget groups.

Console AI sidebar

Every authenticated Console page includes an AI sidebar. It defaults to the Console Operations agent (read-only live data) on most pages, and switches to a specialized agent on context-specific pages (e.g. the Case Center agent on the issue reports page, the Product Loop agent on that page). Operators can also switch agents manually via the sidebar’s assistant picker.

4. Running it

Managing customer businesses

Go to Customer Management → Customer Businesses. This lists all tenant businesses with user counts. From here an operator can:

• Create a new customer business (requires a business name and an initial admin user email/password; domain and subdomain auto-derive from the name)
• Edit business settings and toggle features like AI Builder
• Suspend / Unsuspend a business (requires the Suspend customers permission)
• Grant or revoke bundles to change the business’s licensed app packages
• Destroy a business (SuperAdmin only)

Working sales leads

Demo Requests has no Console sidebar entry. Operators reach it from the Sales section of the dashboard: My Leads, All Leads (not shown to Sales-only operators) and the Lead Pipeline button, which opens the Lead Pipeline Dashboard.

From a lead, an operator with Work demo requests can assign it, update its stage and follow-up date, mark it as spam, or re-sync it to HubSpot. Import Demo Requests (from a CSV file) needs Import demo requests.

Monitoring system health

Go to System Operations → System Health (requires View system health). Additional operational pages:

• Background Jobs — view and manage the job queue
• System Diagnostics — platform-level checks
• System Logs, Admin Action Logs, Authentication Events, API Audit Logs, Notification Logs — each gated by its own permission key
• Alert Settings — configure system alert thresholds and recipients. Alerts are checked every 15 minutes.
• Operations — run declared operational tasks, such as Set Console 2FA policy, which requires 2FA for whole roles and sets their grace period
• Platform Maintenance — take tenants offline for maintenance windows (SuperAdmin only)

Managing apps and licensing

Go to Apps & Licensing → Apps & AI Agents (requires View apps & licensing). From here:

• View all marketplace apps and their status
• Customer Access — manage which tenants have access to which apps
• User Limits — monitor and manage licensed user counts; shows businesses over their limit
• App Reviews — moderate user-submitted app reviews
• App Analytics — usage data across apps

Configuring platform settings

Go to Platform Settings (requires View system settings):

• System Settings — global platform configuration including email delivery controls. The global email kill switch pauses all non-transactional outbound email for every tenant.
• Email Sender Config — SMTP and sender address settings
• SSO Configurations — manage single sign-on providers
• Stripe Configuration — payment processing credentials
• System Users — manage Console operators (requires View users)
• User Permissions — edit role-permission mappings (SuperAdmin only)
• API Tokens and Public API Keys — manage platform-level API credentials

Working with support cases

Go to Support → Support Cases or All Cases (requires View issue reports). Cases can be filtered by category group (support cases vs. feature requests). Operators with Manage issue reports can update status, assign cases, add notes, and reply to users. Case Workflow & SLA configuration is available to Admin-or-above operators.

Viewing billing and revenue

Go to Finance → Revenue Dashboard (requires View billing). Sub-pages for managing packages, app pricing, platform tiers, term/volume discounts, credit packages, and app licensing each require Manage pricing or Manage licensing.

5. Settings

Setting	Where	Default	What it changes
Operator active status	Platform Settings → System Users	Active	Deactivated operators are rejected on their next request
Operator role	Platform Settings → System Users	Viewer	Determines sidebar visibility and page access
Require Two-Factor Authentication	Platform Settings → System Users	Off	Whether the operator must enrol in TOTP
System alerts for operator	System Users → edit operator → Notifications	Role-dependent	On for SuperAdmin, Admin and Engineering; off for other roles
Issue notifications for operator	System Users → edit operator → Notifications	Role-dependent	On for SuperAdmin, Admin and Support; off for other roles
Enable System Alerts	System Operations → Alert Settings	On	Whether platform alerts are raised at all
Enable Email Alerts	System Operations → Alert Settings	On	Whether system alerts send email
Alert Cooldown (minutes)	System Operations → Alert Settings	60	Minimum time before the same alert repeats
Case Center actions	System Users → edit operator → AI Action Access (SuperAdmin only)	Off	Lets the Case Center assistant make confirmed case changes
Console operational actions	System Users → edit operator → AI Action Access (SuperAdmin only)	Off	Lets the Console assistant make confirmed app-access, retry, user-limit, suspend and restore changes
Console role permissions	Platform Settings → User Permissions (SuperAdmin only)	Role defaults	Which permissions each role holds, including the four Demo Requests permissions

6. More help

• MangoApps Console FAQ — specific operating questions, permission troubleshooting, and exact values
• Ask AI — the Console AI sidebar answers questions about live platform state on every Console page.