Already a NinjaOne customer? Log in to view more guides and the latest updates.

Configure Co-Managed Technician Access

  • Last Updated November 4, 2026

Topic

This article describes the co-managed technician access model in NinjaOne Ticketing, including how organization-based access control works, what co-managed technicians can see and do, and how to provision their access.

For comprehensive configuration steps and broader platform context for the features and settings discussed throughout this article, refer to the Additional Resources section.

Environment

NinjaOne Ticketing

Description

Co-managed technicians are frequently customer-side IT users who need to work on tickets within your NinjaOne environment but are restricted to only their assigned organizations. This configuration is common where:

  • Multiple organizations, departments, or customers are managed in a single NinjaOne instance.
  • Support is delivered through a shared-responsibility model between internal teams, represented as Organization-specific technicians in NinjaOne, and a central service desk or support function with broader permissions in NinjaOne.

By adopting co-management workflows, teams benefit from faster issue resolution, clear ownership of responsibilities, and effective cross-collaboration.

Select a topic to learn more.

Understanding Co-Managed Support

In a co-managed support model, a central service desk or IT help desk collaborates directly with an organization's on-site IT team to share support responsibilities.

Because support responsibilities are shared, tickets are assigned between teams, issues are escalated when necessary, and multiple technicians often work together on a single ticket.

When you configure co-managed technician access, an organization's technicians can view all technicians within the co-managed organization and any other technicians with access. They can also assign work directly to these technicians.

This feature does not provide access to other organizations or their data. You can only view and interact with technicians who are authorized to work within your organization's ticketing scope.

Capabilities and Limitations

NinjaOne uses organization-based access control to separate data. This practice ensures:

  • Data confidentiality.
  • Compliance with data protection requirements, including General Data Protection Regulation (GDPR).
  • Prevention of accidental cross-organization exposure.

The underlying design ensures that technicians can access only the tickets assigned to their organizations.

Before configuring access, it is important that you understand what co-managed technicians can see and do, and why these restrictions exist. Select a topic to continue.

Understanding Co-Managed Organizations and Technicians

Co-managed organizations and technicians serve distinct roles within a shared support model.

Co-Managed Organizations

A co-managed organization is an organization within NinjaOne where one or more users from that organization have been provisioned with a Technician-level user account in NinjaOne so they can assist with this organization's device management and ticket handling.

Co-Managed Technicians

A technician, typically employed by or at a target organization to provide direct assistance solely to that entity, whose scope of access and actions is limited either by the Technician role (recommended) or by explicit user permissions to their organization.

Who Co-Managed Technicians Can See

When assigning or working on tickets, co-managed technicians can see:

  • Ticketing-enabled technicians within the same organization.
  • Ticketing-enabled technicians with All Organizations access.
  • System administrator accounts.
System administrators are included because they have All Organizations access and have ticketing activated by default.

A technician is available for ticket assignment only if they are assigned to the same organization or have All Organizations access and ticketing active.

What Co-Managed Technicians Can Do

Can Do Can't Do
View, create, and update tickets. View tickets from organizations to which they are not assigned.
Work tickets within their assigned organizations. Access other organizations' data.
Access tickets via ticket boards, organization dashboards, and email notifications (when assigned or included in updates).

Be restricted solely by board visibility.

For security purposes, you must apply restrictions at the organization level.
Assign tickets to ticketing-enabled technicians within the same organization and those with All Organizations access, including system administrators.

How Co-Managed Technicians Access Tickets

NinjaOne determines ticket visibility based on organization permissions and ticketing permissions. Both must be correctly configured for technicians to access tickets.

Co-managed technicians can reach tickets through three paths: ticket boards, organization dashboards, and email notifications. Organization permissions control ticket access across all three entry points.

For details about each path, refer to NinjaOne Ticketing: Configure Boards, NinjaOne Ticketing: Device and Organization Dashboards, and NinjaOne Ticketing: Email and Notification Management.

Key Considerations

When deploying co-managed support workflows, there are two critical considerations to keep in mind.

Tickets Without Organizations

Tickets that are not assigned to an organization are not governed by organization-based restrictions.

If Tickets without an organization is active, such tickets may be visible outside their intended scope, introducing a risk of unintended data exposure. Always deactivate this setting for co-managed technicians. To learn how to do so, refer to NinjaOne Platform: Permission Settings for Technicians.
Boards and Filters

Ticket boards surface tickets based on defined conditions and may include tickets from one or multiple organizations. Boards control the visibility of ticket lists; they do not control access to tickets.

Board configurations can change over time. If a board that previously only included one organization is modified to include additional organizations, tickets from those organizations may appear on that board.

You must properly restrict organization permissions at the technician role or user level to prevent board changes from introducing unintended visibility. When doing so, remember:

  • Restricting board access does not prevent technicians from accessing tickets through the organization dashboard or through email notifications.
  • Email notifications may include ticket updates, status changes, and direct links to tickets.

For more guidance about configuring ticket boards, refer to NinjaOne Ticketing: Configure Boards.

Ticket Visibility

To configure ticket visibility for a co-managed technician, complete the following steps in the technician role or account. You must configure all organization and board restrictions accurately to eliminate exposure to ticket data outside the intended scope.

The permissions and access considerations described in the following sections apply specifically to ticketing. If you use co-managed access for other areas of the NinjaOne platform, such as device management, review the relevant permissions for those features separately to ensure technicians have only the access they require.

Provisioning Co-Managed Technicians

You can configure co-managed technician access by creating a new role or reusing an existing technician role that is already correctly restricted. We recommend creating a new role.

Starting from the Blank Template means the role begins with no permissions; you add only those the technician requires. This approach enforces least privilege and reduces the risk of over-provisioning. You can also assign permissions directly to a technician account, though role-based configuration is easier to audit and maintain over time.

Follow the steps defined in NinjaOne Platform: User Roles to create a technician role, select the Blank Template, and add required permissions.

Organization Permissions

Organization permissions determine which organizations' tickets a technician can access. Navigate to Permissions → Organizations in the technician role or account, activate the section, and assign only the organizations the technician requires. A co-managed technician may be assigned to multiple organizations if they belong to the same customer, for example, sites or subsidiaries.

Any assigned organization becomes visible to the technician. Because tickets are accessible via boards and organization dashboards, this setting defines all ticket visibility.

You can find step-by-step instructions about configuring organization permissions in a technician role or account in our NinjaOne Ticketing: Technician and User Permissions article.

Ticketing Permissions

Ticketing permissions control the actions a technician can take on tickets. Navigate to Permissions → Ticketing in the technician role or account, activate the section, and configure the required actions. Ticket Actions must have a minimum setting of View.

Locate Tickets without an organization and ensure it is deactivated. Tickets that are not assigned to an organization are not subject to organization-based restrictions. If this setting is active, those tickets may become visible to the technician outside their intended scope.

Refer to NinjaOne Ticketing: Technician and User Permissions and NinjaOne Platform: Permission Settings for Technicians for further guidance about ticketing permission configurations, including definitions for each permission option.

Pending Emails Board

The Pending Emails board includes tickets generated from incoming emails before they are fully processed and associated with an organization. This board can contain tickets from multiple end users and contacts across different organizations, particularly before organization mapping is applied.

If organization permissions are not correctly restricted at the technician or user role level, and board filters are modified to include additional organizations, this board can expose ticket data beyond the intended scope.

The Pending Emails board must be set to No Access for all co-managed technician roles. You must configure this setting during initial setup. It is a mandatory control, not a post-deployment adjustment.
Board Access

Board access controls determine which ticket boards appear in the technician's console navigation. They do not control access to tickets. Navigate to Permissions → Boards in the technician role or account and assign only the boards the technician requires.

Board configuration alone does not prevent data exposure. Proper organization-level permission scoping is required to ensure visibility remains restricted.

Learn how to create and manage ticketing boards, including the filter conditions that affect co-managed technician visibility, in NinjaOne Ticketing: Configure Boards.

End User and Contact Visibility

End-user and contact visibility settings control whether a co-managed technician can view, create, or edit end user records and contacts. As with ticketing, these functions are restricted by the technician's access or by their role's access to organizations.

  • End Users: Navigate to Permissions → System and activate End User Sharing.
    • When active, this permission allows viewing, updating, and creating end users within the co-managed technician's organization.
  • Contacts: Navigate to Permissions → System → Manage Contacts and configure the level of access you would like the co-managed technician to have.
    • When active, this setting allows viewing, editing, creating, and deleting contacts within the co-managed technician's organization. Available management options are limited by the assigned organization's settings. Consider whether you would like the technician to only be able to view the organization's contacts or also be able to manage them. Limit contacts to assigned organizations, and validate that the restriction delivers the intended results in your environment.

To get started with end user and contact configuration, refer to NinjaOne Ticketing: Technician and User Permissions.

Assign the Role or Permissions

Apply the configuration by assigning the role to the technician's account or by assigning permissions directly. Assigning a role is recommended, as role-based access is easier to audit and update over time.

If the technician's account carries multiple roles, the most permissive role determines the technician's effective access level. Confirm that each role is correctly scoped before completing the configuration.

NinjaOne Platform: User Roles explains how to assign a role to a technician account and how to manage access when multiple roles are in use.

Additional Resources

The following topics provide comprehensive configuration steps and broader platform context for the features and settings discussed throughout this article.

FAQ

Next Steps