"Enter as this user": support sessions explained

A support session ("Enter as this user") lets a super admin see Current as another person sees it (same workspace, same role, same personal surfaces) for up to two hours, with a pink banner on screen the whole time and a start and end entry written to the audit log. It is a troubleshooting and QA tool. It is not a password: no one learns or resets anyone's sign-in credentials, and nothing you do inside a session is recorded as if the other person did it.

Only super admins can start one, and super-admin status can only be held by a member of Current's own primary workspace. A Tenant Admin, Project Manager, Engineer, Account Executive, or partner cannot start a session at all. The buttons don't appear for them, and the underlying request is refused by the database layer even if it is called directly.

The distinction matters. "Enter tenant" is a workspace switch, useful when a Tenant Admin says "my PSA sync looks wrong" and you need to look at their settings. "Enter as…" and "Enter as this user" are downgrades: they restrict what you can see to what that role or person can see, which is the whole point when someone reports "I can't find the opportunity" or you want to check what a partner is actually looking at.

Inside a session, every screen shows the entered workspace's own data, including the Integrations page. Connection statuses, credential tests, Sync now, and connect or disconnect all read from and act on the workspace you entered, never your home workspace, so what you see there is exactly what that workspace's own admin sees.

Super admins may also keep a demo workspace. A tenant badged "Demo" in Platform → Tenants & billing (ours is "Pebkac MSP") that is filled with entirely fictional companies, projects, tickets, emails, and opportunities for product demos and for QA-ing exactly what a real workspace sees after a change. A demo workspace is deliberately inert: it never syncs with Autotask or Microsoft 365, never sends email, and never calls any outside service, its integrations only look connected. The Seed / Reset button on that screen rebuilds its sample data from scratch, and Refresh timestamps makes everything look recently active before a demo. Demo data is invisible to every real workspace, exactly like any other tenant's data.

A super admin can make another member of Current's own platform workspace a platform operator, from Settings › Users and roles › People: open their row and turn on Platform operator. An operator opens Platform → Tenants & billing and sees every account, its billing, its people (with the CSV export), the Metrics tab and the Support tab. On billing, an operator can do exactly three things: extend a free trial, defer billing to a later date, and pin the billing contact.

An operator can never start a support session, so Enter tenant, Enter as… and Enter as this user never appear for them. They also cannot refund, charge, change seats, a plan, a price or a discount, cancel or delete a workspace, or change its modules, sign-in or metrics settings. The database and the console's server refuse each of these whatever the screen shows, and every billing action an operator takes is written to the audit log with their name on it.

1. 1
   To see another workspace, go to Platform → Tenants & billing → Accounts

   Each tenant row has an Enter tenant button (hidden for your own workspace. There's nothing to enter), and an Enter as… dropdown labelled "View this workspace as", offering Partner (read-only), Account Executive, Engineer, and Project Manager.
2. 2
   To see it as one person, go to Settings › Users and roles › People

   Click that member's row and choose Enter as this user at the foot of the panel. The option only appears for super admins, and never on your own row.
3. 3
   Let the app reload

   Current clears its cached data and does a full page load so nothing from your own identity paints on the new view. Entering as a partner drops you into the partner portal; every other role lands in the staff app.
4. 4
   Check the banner

   A pink bar sits across the top of every page: "Viewing Northwind Dental as Alex, Project Manager" (or "as super admin" for a plain tenant switch). It follows you into the partner portal too, so you can never be lost inside someone else's view.
5. 5
   Exit when you're done

   Press Exit on the banner. Current ends the session, clears the cache again, and reloads you back into your own identity and workspace.

Super-admin grants and cross-tenant moves are checked against your real account (an un-maskable check on the true signed-in principal), so a masked session can never spoof that authority, and Exit is checked the same way, meaning you can always get back to yourself. Ordinary role changes still go through the normal tenant-admin gate, which a role-masked session switches off. Note that a plain "Enter tenant" session keeps your super-admin powers, so you can administer that workspace's members while inside it. That is the point of the mode, and it is audit-logged.

• Starting a session writes an impersonation_start entry, tagged with your real account's email (and user id), the workspace name, the role you're acting as, and the id of the person (if any) you entered as.
• Exiting writes a matching impersonation_end entry.
• Both are platform records for Current's super admins only. The workspace's own Tenant Admins do not see them in their Audit log, and neither do you while you're inside the workspace. No one can edit an audit entry from inside Current, a super admin included.
• Current also keeps a separate record of every support visit: who entered, which workspace, and when the visit started and ended. That record is kept even if the workspace is later deleted.
• Anything you do that IS audit-logged (projects, profiles, time entries, opportunities, connectors, campaigns and the other audited tables) is recorded under your real identity, never the person you're viewing as. Actions on non-audited surfaces (for example tasks and comments) still save as YOU, but do not produce their own audit-log line.

That combination is what you point a security reviewer at when they ask "can your staff log into my account?" The answer: a named Current super admin can start a time-boxed session to see what you see, they cannot act as you, both ends of that session are recorded, and the record of the visit is kept even if the workspace is later deleted. See "The audit log: what's recorded and who can read it".