MangoApps Console FAQ
Answers to common setup and operating questions about the MangoApps Console.
For what the Console is and how to set it up from scratch, see the
MangoApps Console Overview.
Setup
Do I need to create a separate account for each Console operator?
Yes. Console operator accounts are entirely separate from tenant user accounts. A person can have both a tenant user account and a Console operator account, but they are independent — different credentials, different sessions, different permissions. Create operators at Platform Settings → System Users.
What role does a new operator get by default?
Every new operator is created with the Viewer role and is active immediately. Viewer is the most restrictive role — it grants read access only where a permission has been explicitly assigned to it. Promote the operator to a more capable role after creation.
Can an operator hold more than one role?
Yes. Operators can hold multiple roles simultaneously via the role assignment UI. When multiple roles are held, the highest-priority role becomes the primary. The priority order is: SuperAdmin (1), Admin (2), Engineering / Product / Marketing / Sales / Finance / Legal / Support (all level 3), Viewer (4). The operator’s effective permissions are the union of all their roles’ permission grants.
Permissions and access
Why can’t my operator see a particular sidebar section?
Every sidebar section maps to a permission category (for example View customers, View billing, View operations). If the operator’s role(s) do not grant the required permission, the section is hidden. Only a SuperAdmin can edit role-permission mappings at Platform Settings → User Permissions. SuperAdmin holders bypass all permission checks and always see everything.
Which operations are restricted to SuperAdmin only?
Four operations require the SuperAdmin role regardless of permission grants: destroying a customer business, editing role-permission mappings (Platform Settings → User Permissions), generating magic login links, and activating platform-wide maintenance mode. These are fixed role checks — no permission grant substitutes for the SuperAdmin role.
Who can access the Console dashboard?
Every authenticated operator can access the dashboard — it is exempt from permission checks. However, the widgets shown depend on the operator’s role(s): Sales/SuperAdmin/Admin see pipeline widgets, Marketing/SuperAdmin/Admin see AI conversation and demo request widgets, Support/SuperAdmin/Admin see case widgets, and SuperAdmin/Admin/Engineering see platform health widgets. Operators with multiple roles see the union of all applicable widget groups.
Two-factor authentication
How long does an operator have to set up 2FA after it’s required?
24 hours. When a SuperAdmin requires 2FA for an operator, a deadline is set 24 hours from that moment. During the grace period the operator can still sign in but sees a warning. Once the deadline passes, the operator is signed out on the next request and cannot sign in again until a SuperAdmin either extends the deadline or disables the 2FA requirement.
How many backup codes does an operator get?
10 backup codes, each a 10-character hex string. Each code is single-use — once used to authenticate, it is removed from the list. Backup codes are encrypted at rest. A SuperAdmin can fully reset another operator’s 2FA (clearing the secret, codes, and enrollment state) from the System Users page.
What happens if an operator loses access to their authenticator app and all backup codes?
A SuperAdmin can disable 2FA entirely for that operator from Platform Settings → System Users using the “Disable 2FA” action. This resets all 2FA fields (secret, backup codes, enrollment status) and the operator can sign in with just their password. If 2FA is still required for that operator, a new 24-hour enrollment deadline is set automatically.
Sessions and authentication
How long does a Console session last?
The session cookie expires after 8 hours of inactivity. Additionally, an absolute session timeout of 24 hours is enforced — the operator is signed out 24 hours after login regardless of activity. There is no “remember me” option for Console sessions.
How long is a password reset link valid?
6 hours from when it was generated. After that, the operator must request a new one.
Can operators sign in with Google SSO?
Yes, but only from mangoapps.com or mangospring.com email domains. Google SSO does not auto-provision accounts — the operator must already have a Console operator account with a matching email address.
Day-to-day operations
How do I pause all outbound email across every tenant?
Go to Platform Settings → System Settings → Email Delivery. The global email kill switch pauses all non-transactional outbound email platform-wide. You must provide a reason (up to 500 characters) and choose a duration: 15 minutes, 1 hour, 4 hours (default), 24 hours, or indefinite. Transactional mail (OTPs, password resets, verification codes) is always exempt. Requires the Edit email settings permission.
What happens when I suspend a customer business?
Suspending marks the business inactive. All users in that business are immediately gated with a 503 response — they cannot access the tenant platform while suspended. Unsuspending marks it active again and access resumes. Both actions require the Suspend customers permission.
What is the difference between suspending a business and putting it in maintenance mode?
Suspension is a durable account state — the business stays suspended until an operator explicitly unsuspends it. Maintenance mode creates a temporary maintenance window that can block web, API, integrations, and mobile access. Console-forced maintenance windows turn Admins keep access off, meaning even tenant admins cannot bypass them. Only a SuperAdmin can activate platform-wide maintenance or force maintenance on a specific tenant.
Can the Console AI sidebar take actions, or only answer questions?
Both, depending on which agent is active. The Console Operations agent (the default on most pages) is read-only — it queries live platform data but cannot change anything. The Console Admin agent can execute confirmation-gated write operations (e.g. toggling app access for a tenant, retrying a failed background job, suspending a business), but it must be explicitly enabled per operator. The Console operational actions switch on the operator’s record at Platform Settings → System Users is off by default. An operator also needs at least one of the action permissions (Manage customer access, View background jobs, View diagnostics, View notification logs, or Suspend customers).
When something looks wrong
“I’m locked out of the Console after my 2FA setup period expired”
A SuperAdmin must either extend your deadline (granting another 24 hours) or disable 2FA for your account from Platform Settings → System Users. You cannot resolve this yourself — the login page will show “Your two-factor authentication setup period has expired. Please contact a system administrator.”
“I deactivated an operator but they’re still logged in”
Deactivation is checked on every request. The operator will be rejected on their next request — there is no need to wait for session expiry. If they appear to still be active, they may have a cached page; the next navigation or API call will fail.
Limits and exact values
Are there limits on the Console AI sidebar?
Yes. Messages are capped at 10,000 characters each. The rate limit is 15 turns per minute per operator. The sidebar requires at least one of these permissions: View AI logs, Manage AI logs, View customers, or View issue reports.
What is the CSV export limit for authentication events?
50,000 rows. The export runs synchronously in the request and spans all tenants, so it is bounded to prevent timeouts. Apply filters (business, event type, date range) to narrow the result set before exporting.
More help
- MangoApps Console Overview
- Ask AI — the Console AI sidebar answers questions about live platform state on every Console page.