Document App Roles and Permissions During Client Onboarding When onboarding a new client, MSPs carefully review devices, networks, and user accounts. But there’s one critical area that often gets overlooked: SaaS applications and their roles in permissions. In this guide, we'll walk through practical methods that MSPs can use to capture SaaS role assignments effectively. Before we begin, be sure to subscribe to NinjaOne’s IT video hub and our YouTube channel for more tech content like this. Why SaaS Role Documentation Matters First, why does SaaS role documentation matter for MSPs? By embedding this process directly into your onboarding process, you can accomplish the following. Reduce access risks by enforcing least privilege. Create audit-ready records for frameworks like ISO 27001, HIPAA, and GDPR. Streamline access reviews and role adjustments. Provide clients with a consistent, repeatable governance process Without proper documentation of SaaS roles and permissions, gaps can quickly emerge—overprovisioned access, unclear administrative rights, and compliance blind spots. Prerequisites to Document App Roles and Permissions Before you begin documenting app-specific roles and permissions, Make sure these are in place. Access to the SaaS application’s admin dashboard where roles and permissions are configured. A predefined RBAC framework (grounded in the principle of least privilege, to ensure consistency and scalability) A documentation template (e.g., a spreadsheet, IT Glue, a wiki, or another documentation system) Optional) Leverage scripting or API access to automate the export of role and permission data. With the above prerequisites met, you can start this operation with a definition of a standard documentation template. How to Document App Roles and Permissions During Client Onboarding Your documentation template is the foundation of audit trails and repeatability. Each SaaS application should be documented consistently capturing the following details. Application name Role types (e.g., Admin, Editor, Viewer) Assigned users or departments Permission levels Assignment date and approver Notes or business rationale Next, instead of assigning permissions user by user, implement role-based access control from day one. Group employees by function—such as HR, finance, or IT and then map those groups to appropriate application roles. This simplifies management, reduces complexity, and enforces least-privilege access at scale. If exceptions are required, such as temporary elevated access, document them clearly to maintain compliance readiness. Onboarding is the ideal time to capture a clean baseline snapshot of permissions. For each SaaS application, document the following information: Default roles offered (e.g., Global Admin, Power User, End User) Role hierarchies and privileges (what each role can access, modify, or control) Security add-ons (e.g., MFA requirements, conditional access policies, data segregation settings) This snapshot becomes the governance starting point for the client's SaaS environment. Manual documentation can be time-consuming and prone to error. For this reason, many SaaS platforms provide APIs or integrations that allow you to export role assignments automatically. For example, this command retrieves all role assignments for the application and saves them into a structured CSV file. Next, to ensure consistency, integrate SaaS documentation directly into your onboarding process. You can embed documentation tasks into your onboarding checklist. Assign clear ownership and require formal sign-off before marking onboarding complete. This makes role documentation a required deliverable, not an afterthought. Lastly, governance doesn't end at onboarding. Set expectations early by defining a review cadence and aligning these reviews with compliance frameworks and QBRs. Also, make sure to document the agreed-upon schedule within the onboarding package. Building a secure and compliant environment requires structure, making SaaS role and permission documentation during onboarding a crucial task for any MSP. When organizations treat role documentation as a critical onboarding deliverable, they strengthen client trust as well as lay the foundation for safer, more transparent SaaS operations. For more information, check out our official blog post on documenting app-specific roles and permissions, linked in the description below. Be sure to subscribe to NinjaOne's IT Video Hub and our YouTube channel for more tech content like this.