MangoApps Console

MangoApps Console

1. What it is

The MangoApps Console is the platform-wide administration portal for managing tenants (customer businesses), billing, app licensing, AI configuration, system operations, and compliance. It runs on its own subdomain — separate from any tenant — and is used by the team that operates the platform, not by tenant admins or end users.

• Access: The Console lives at console-{env}.workforce.mangoapps.com (e.g. console.workforce.mangoapps.com in production). The legacy sysadmin.* hostname redirects here.
• What it is not: The Console is not a tenant admin panel. Tenant admins manage their own business at Admin → within their subdomain. The Console manages the platform across all tenants.

2. Standing it up

Console operator accounts are entirely separate from tenant user accounts. A SuperAdmin creates operators and assigns their roles.

1. Sign in at the Console URL. Authentication is email + password, with optional TOTP two-factor.
2. Go to Platform Settings → System Users to create new operators. Each operator needs a first name, last name, email (must be unique), and a password.
3. Assign one or more roles to the operator. Roles determine which sidebar sections and pages they can access. The ten available roles are: SuperAdmin, Admin, Engineering, Product, Marketing, Sales, Finance, Legal, Support, Viewer.
4. Optionally tick Require Two-Factor Authentication for the operator. If required and not yet set up, the operator gets a 24-hour grace period to complete TOTP enrollment before their access is restricted.
5. Confirm the operator can sign in and sees the sidebar sections appropriate to their role assignment.

A new operator defaults to the Viewer role and is active immediately. SuperAdmin is the only role that implicitly holds every permission — all other roles see only the pages their permission grants cover.

3. How it fits together

Operators and roles

Console operators are separate from tenant users. An operator can hold multiple roles simultaneously; the highest-priority role becomes the primary. The role hierarchy from highest to lowest priority: SuperAdmin (1), Admin (2), then Engineering / Product / Marketing / Sales / Finance / Legal / Support all at level 3, and Viewer (4).

SuperAdmin holders bypass all permission checks. For every other role, access is resolved through role-permission mappings — each role is granted a set of named permissions (for example View customers or Manage pricing), and every Console page maps to the permission it requires.

Permission categories

Permissions are organized into categories that correspond to sidebar groups. The main categories: Customers, Billing, Apps & Licensing, AI & Automation, Operations, System Settings, Users, API Tokens, Issue Reports, Legal & Compliance, Training, Knowledge Base, Company Store, and several others. Each category has view, create, edit, delete, and specialized entries (for example Manage pricing under Billing, or Manage OpenAI keys under AI & Automation).

Only a SuperAdmin can edit role-permission mappings (Platform Settings → User Permissions).

Two-factor authentication

Console 2FA uses TOTP (time-based one-time passwords). When enabled, the operator is prompted for a code after entering their password. Ten backup codes are generated at setup and encrypted at rest. A SuperAdmin can require 2FA for any operator — the operator then has 24 hours to complete enrollment or their access is locked.

Dashboard

The Console dashboard is role-aware. It shows different widget groups depending on the operator’s roles:

• Sales (Sales, SuperAdmin, Admin): lead counts, pipeline stages, overdue follow-ups
• Marketing (Marketing, SuperAdmin, Admin): AI conversations, demo requests, assessments
• Support (Support, SuperAdmin, Admin): new/active/critical cases, personal case count
• Platform (SuperAdmin, Admin, Engineering): total/active businesses, user counts, 2FA adoption, failed logins

Operators with multiple roles see the union of all applicable widget groups.

Console AI sidebar

Every authenticated Console page includes an AI sidebar. It defaults to the Console Operations agent (read-only live data) on most pages, and switches to a specialized agent on context-specific pages (e.g. the Case Center agent on the issue reports page, the Product Loop agent on that page). Operators can also switch agents manually via the sidebar’s assistant picker.

4. Running it

Managing customer businesses

Go to Customer Management → Customer Businesses. This lists all tenant businesses with user counts. From here an operator can:

• Create a new customer business (requires a business name and an initial admin user email/password; domain and subdomain auto-derive from the name)
• Edit business settings and toggle features like AI Builder
• Suspend / Unsuspend a business (requires the Suspend customers permission)
• Grant or revoke bundles to change the business’s licensed app packages
• Destroy a business (SuperAdmin only)

Monitoring system health

Go to System Operations → System Health (requires View system health). Additional operational pages:

• Background Jobs — view and manage the job queue
• System Diagnostics — platform-level checks
• System Logs, Admin Action Logs, Authentication Events, API Audit Logs, Notification Logs — each gated by its own permission key
• Alert Settings — configure system alert thresholds and notification recipients
• Platform Maintenance — take tenants offline for maintenance windows (SuperAdmin only)

Managing apps and licensing

Go to Apps & Licensing → Apps & AI Agents (requires View apps & licensing). From here:

• View all marketplace apps and their status
• Customer Access — manage which tenants have access to which apps
• User Limits — monitor and manage licensed user counts; shows businesses over their limit
• App Reviews — moderate user-submitted app reviews
• App Analytics — usage data across apps

Configuring platform settings

Go to Platform Settings (requires View system settings):

• System Settings — global platform configuration including email delivery controls. The global email kill switch pauses all non-transactional outbound email for every tenant.
• Email Sender Config — SMTP and sender address settings
• SSO Configurations — manage single sign-on providers
• Stripe Configuration — payment processing credentials
• System Users — manage Console operators (requires View users)
• User Permissions — edit role-permission mappings (SuperAdmin only)
• API Tokens and Public API Keys — manage platform-level API credentials

Working with support cases

Go to Support → Support Cases or All Cases (requires View issue reports). Cases can be filtered by category group (support cases vs. feature requests). Operators with Manage issue reports can update status, assign cases, add notes, and reply to users. Case Workflow & SLA configuration is available to Admin-or-above operators.

Viewing billing and revenue

Go to Finance → Revenue Dashboard (requires View billing). Sub-pages for managing packages, app pricing, platform tiers, term/volume discounts, credit packages, and app licensing each require Manage pricing or Manage licensing.

5. Settings

Setting	Where	Default	What it changes
Operator active status	Platform Settings → System Users	Active	Deactivated operators are rejected on their next request
Operator role	Platform Settings → System Users	Viewer	Determines sidebar visibility and page access
Require Two-Factor Authentication	Platform Settings → System Users	Off	Whether the operator must enroll in TOTP
Two-factor status	Platform Settings → System Users	Disabled	Enrollment state: Disabled → setup started → awaiting code confirmation → Enabled
System alerts for operator	Operator’s own notification preferences	Role-dependent	SuperAdmin/Admin default to on; Support, Engineering, others default to off
Issue notifications for operator	Operator’s own notification preferences	Role-dependent	SuperAdmin/Admin/Support default to on; others default to off
Email alerts enabled	System Operations → Alert Settings	On	Whether system alerts send email
Dashboard alerts enabled	System Operations → Alert Settings	On	Whether system alerts show on the dashboard
Alert cooldown	System Operations → Alert Settings	60 minutes	Minimum time between repeated alerts
Console operational actions	Platform Settings → System Users	Off	Enables confirmation-gated write operations via the Console AI sidebar

6. More help

• MangoApps Console FAQ — specific operating questions, permission troubleshooting, and exact values
• Ask AI — the Console AI sidebar answers questions about live platform state on every Console page.