Skip to main content

The client portal user guide

Updated

Overview

The Client Portal is your organization's self-service window into the IT services your provider (MSP) delivers. It's where you open help tickets, check the status of your devices and backups, pay invoices, review security reports, complete security-awareness training, and (for schools) review Shield student-safety alerts. The portal is typically branded with your provider's or your organization's logo and lives at app.theonestack.com/portal or at a custom address your provider set up for you, such as support.yourcompany.com.

Key Features

  • Dashboard — a single landing page showing open tickets, recent activity, security highlights, and quick links to the things you'll use most.
  • Get Help From THEO — browse a catalog of common requests (password reset, software install, new hire onboarding, etc.) and submit them with a short form.
  • Support tickets — open new tickets, track the ones you've submitted, reply on a thread, and see status (Open, Pending, Resolved, Closed).
  • Billing & Invoices — view and pay invoices (if your provider uses pass-through billing), download PDF invoices.
  • Security Dashboard — security posture score, SAT (Security Awareness Training) course status, dark-web monitoring alerts, compliance status.
  • Training Dashboard (/portal/training) — your training landing page. Its Security Training card opens Cypher.
  • Security Training (Cypher) — gamified phishing and security-awareness training with XP, levels, streaks, leaderboards, and achievements.
  • Devices — list of computers, servers, mobile devices, and network equipment the MSP manages for you, with status and patch information.
  • Backups — status of your backup jobs: healthy, warning, or failed, plus storage usage.
  • Chromebook Management (K-12 schools) — your child's or your school's Chromebook fleet.
  • Projects — view active projects your MSP is working on for you.
  • Reports — downloadable or embedded reports.
  • Apps — launcher for any products your provider has made available to you (e.g. Space, Projects, CRM, Fleet, Voice).
  • Trusted Devices & Sign-In — manage your passkeys, push-notification-enabled devices, and Security PIN.
  • Shield (schools) — student-safety views for school admins, counselors, staff, and parents.
  • Parent portal — parents/guardians of students whose schools use Shield can review alerts and message counselors.

The exact set of sections visible to you depends on what your provider has enabled. If you don't see a section mentioned here, it's either turned off for your organization or you don't have permission for it.

How To: Sign in to the portal

  1. Go to the portal URL your provider gave you (e.g. support.yourcompany.com or app.theonestack.com/portal).
  2. Enter your email address, then either your password, or click Email me a sign-in link instead for a one-time link (valid 15 minutes).
  3. If your provider has enabled Microsoft sign-in for your organization, you can click Continue with Microsoft 365 instead.

There is no invitation to accept. Your provider adds you as a portal contact from their own tools, and the portal does not email you an invitation when they do.

How To: Set up Two-Factor Authentication (MFA)

  1. Open Account in the sidebar (or My Account).
  2. In the Security section, click Enable next to Two-Factor Authentication.
  3. Scan the QR code with your authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, Authy).
  4. Enter the 6-digit code from the app to confirm.
  5. Save the recovery codes shown — you'll need one if you lose your phone.
  6. Next sign-in will ask for a code from your authenticator.

How To: Enroll a passkey (Face ID / Touch ID / Windows Hello)

Passkeys let you sign in without a password using your device's biometrics.

  1. Go to Trusted Devices in the sidebar.
  2. Click Add Passkey under Enrolled Passkeys.
  3. Follow your browser's biometric prompt.
  4. Name the passkey (e.g. "iPhone", "Work Laptop").
  5. Next sign-in, choose passkey and confirm with biometrics.

To remove one, click the trash icon next to it.

How To: Set a Security PIN

A 6-digit Security PIN is a separate, quick way for THEO or your MSP's help desk to verify it's really you when you ask for something sensitive (like a password reset or access change).

  1. Go to Trusted Devices → Security PIN.
  2. Click Set PIN (or Change PIN).
  3. Enter a 6-digit PIN — not 000000, not 123456, not all the same digit, and not 6 sequential numbers.
  4. Confirm.

If you forget it and get locked out, your IT provider can reset it — you can't reset it yourself (that's the defense against social engineering).

How To: Submit a support ticket

  1. Click Support in the sidebar, then Submit Ticket (or go to Support → New Ticket).
  2. Pick a category: General, Hardware, Software, Network, Email, Security, or Other.
  3. Pick a priority: Low, Medium, or High.
  4. Enter a subject (short description) and a detailed description.
  5. Attach files if relevant (screenshots, error messages). If you don't see an attachment option, file uploads are turned off for your organization.
  6. Click Submit. Your ticket appears in My Requests, where you can track its status.

You'll receive email and in-portal notifications when a technician responds.

How To: Get help from THEO (self-service)

THEO can run many common requests automatically — faster than opening a ticket.

  1. Click THEO in the sidebar (or, from Support, choose Ask THEO).
  2. Browse categories: Identity, Device, Software, Security, Onboarding, Other.
  3. Click a runbook (e.g. "Reset my password", "Install software", "Enable MFA").
  4. Fill in the short form — THEO shows exactly what inputs it needs.
  5. Depending on the request's trust tier, you may be asked for a PIN, push approval, or MFA code.
  6. Submit. Follow progress at My Requests.

Requests that succeed resolve themselves without human involvement. Anything THEO can't handle is escalated into a normal support ticket automatically.

How To: Track your requests

Go to My Requests in the sidebar. You'll see every THEO self-service request you've submitted, its state (Pending, In Progress, Completed, Requires Info), and any outputs or questions THEO is waiting on from you.

How To: Pay an invoice

If your provider bills you directly through the portal:

  1. Click Billing in the sidebar.
  2. The dashboard shows total outstanding, next due date, and last payment.
  3. Click an unpaid invoice (status: Sent or Overdue) to expand it.
  4. Click Pay now. You'll be redirected to a secure Stripe checkout.
  5. Enter your card or bank (ACH) details and confirm. The invoice flips to Paid within seconds.

To download a PDF of any invoice, click the download icon next to it.

If you see a blue "Managed billing" banner saying Your subscription is managed by your service provider, your provider handles billing on your behalf and you don't need to pay through the portal.

How To: View your security posture

  1. Click Security in the sidebar.
  2. You'll see a score out of 100 (green ≥ 71, amber 41–70, red < 41) plus:
    • SAT courses — your assigned security-awareness training, with status (Completed, In Progress, Assigned, Overdue).
    • Dark-web alerts — any of your company emails or credentials that showed up in a known breach.
    • Compliance status — framework requirements (e.g. HIPAA, PCI) the MSP is tracking for you.
  3. Click through any item for detail.

How To: Complete Cypher (security training)

Cypher is a short, gamified training that runs 5–10 minutes at a time.

  1. In the portal sidebar, under Security and Training, click Training Dashboard (/portal/training, for example app.theonestack.com/portal/training, or the same path on your provider's custom portal address).
  2. On the Security Training card, click through to open Cypher (/portal/cypher). The card shows your season progress, and Continue under it opens your recommended episode.
  3. If there's a scheduled scenario, click Start Session. Otherwise, the dashboard shows your level, monthly XP, streak, and weak-skill domains.
  4. Play through the scenario — answer multiple-choice questions based on a realistic phishing or social-engineering situation.
  5. See your score, XP earned, and the debrief explaining right and wrong choices.
  6. Check Leaderboard, Achievements, and History tabs to compete with co-workers and review past sessions.

Scores below a threshold mark the skill domain as "weak" and you'll see more scenarios in that area.

How To: View your devices

  1. Click Devices in the sidebar.
  2. Filter by type (workstation, server, laptop, mobile, network) or status (online, warning, offline).
  3. Expand a device to see details: user, patch status (Up to Date, Pending, Critical), last check-in, hardware info.
  4. Request help on a device (open a ticket with it pre-filled) via the Headset icon.

How To: Check your backups

  1. Click Backups in the sidebar.
  2. Each backup system shows health (Healthy / Warning / Failed), last backup time, storage used versus quota, and next scheduled run.
  3. Expand a system to see details and request restore assistance.

How To: Manage your Chromebooks (K-12)

  1. Click Chromebooks in the sidebar (appears only if your school has this enabled).
  2. See each device assigned to you or your student, its status, and last sync time.
  3. Click into a device for details and to request action (lock, locate, reset).

How To: Update notification preferences

  1. Click Account in the sidebar.
  2. In the Notifications section, toggle Email and Portal for each category: Support Tickets, Billing & Invoices, Security Alerts, Backup Status, Project Updates, System Notifications. These choices are saved to your account but do not decide what gets sent yet — your IT provider controls that for now.
  3. Optionally record your consent for SMS notifications. Enter your mobile number, tick the consent checkbox, and save — the portal stores your choice but does not send text messages yet.
  4. Click Save.

How To: Change your password

  1. Click Account → Security, or use the Forgot password link on the sign-in page if you're locked out.
  2. Enter current, then new password (minimum 10 characters with upper, lower, and digit), confirm, and save.
  3. All your other sessions are signed out.

If you forgot it, use the reset link emailed to you (valid 1 hour).

How To: Add a teammate to the portal

Portal users are added by your IT provider, not from inside the portal — there is no Team page, and no invitation email is sent to the person you add.

  1. Ask your provider to add the person's email address as a portal contact, and to say which role they should have:
    • Admin — full portal access; the widest set of portal sections your organization has enabled.
    • User — standard access (submit tickets, view reports).
    • Viewer — read-only.
  2. Tell them to go to the portal URL and click Email me a sign-in link instead to get in.
  3. To remove someone's access, ask your provider to deactivate them.

You can't change anyone's portal access yourself — ask your IT provider to add, change or remove it.

How To: View and launch apps

  1. Click Apps in the sidebar.
  2. See the apps your provider has enabled for you (Reports / Clarity, Space, Projects, CRM, Fleet, Voice as available).
  3. Click to launch. Some open inside the portal; others open in a new tab.

How To: Access the Knowledge Base

  1. Click KB (Knowledge Base) in the sidebar.
  2. Browse or search articles your provider has published — common IT how-tos, company policies, onboarding guides.

How To (Shield — Schools): For a School Admin

  1. Click Shield Dashboard in the sidebar.
  2. See DNS health for your school's network (query volume, block rate, top blocked categories), CIPA compliance status, and any open Sentinel alerts (students flagged for self-harm, bullying, or other safety issues).
  3. Click through to Alerts to triage, Parents to manage parent/guardian access, Reports for CIPA compliance reports.

How To (Shield — Schools): For a Counselor

  1. Click My Alerts in the sidebar — alerts currently assigned to you.
  2. Click All Alerts to see unassigned or cross-school alerts.
  3. Open an alert to review the student's flagged content, classification, and recommended actions. Add a comment thread with the student's parent.
  4. Mark the alert as Reviewed, Escalated, or False Positive.

How To (Shield — Schools): For a Parent

  1. Click My Alerts in the sidebar (your school adds you as a parent contact).
  2. See any safety alerts involving your child, with the classification and what the school has done.
  3. Reply on the iMessage-style thread to the counselor or school admin.
  4. Click My Children to see all children linked to your account (one parent can be linked to multiple students).
  5. Additional schools can be linked if you have children at more than one — they'll appear in a "Link to this school?" prompt automatically when detected.

How To (Shield — Schools): For Read-Only Staff

If you're a general school staff member, Alerts appears in the sidebar as read-only. You can view flagged content and assignments but cannot take action — that's reserved for counselors and admins.

Frequently Asked Questions

My sign-in link says "expired" or "invalid."

Sign-in links are single-use and valid for 15 minutes. Request a new one from the sign-in page. There is no invitation link to expire — none is ever sent.

I'm not seeing Billing (or Security, or Backups, etc.) — where is it?

Your MSP enables each section for your organization individually, and some sections depend on your role. Billing is often limited to account owners and admins, so members may not see it. If something is missing, ask your company's portal admin or your MSP.

I forgot my password and the reset email didn't arrive.

Check spam. The link expires in 1 hour — if it's older, request another. If it still doesn't arrive, contact your MSP directly; your account may be locked or disabled.

How is the portal related to my provider's other tools?

The portal is a white-labeled view into the same IT platform your MSP uses. Tickets you open become tickets in their PSA; devices you see are from their RMM; backups from their backup product. Everything is live.

I opened a ticket but don't see it in the list.

Check your filters (Status: All, Priority: All). If it's still missing, the ticket may have been merged or moved by a technician — they'll have emailed you about it.

Can I submit a ticket by email?

If your provider set up email-to-ticket, yes — send to the address they gave you. Otherwise, use the Submit Ticket form.

My session keeps timing out.

Portal sessions last 8 hours. 5 minutes before expiry you see a "Stay signed in?" toast — click it. If you dismiss or walk away, you're signed out safely.

Can I use the portal on my phone?

Yes — the portal is mobile-responsive. For frequent use, some providers offer a branded mobile app too.

I got a text message saying I have an alert but I'm not signed up for SMS.

The portal does not send text alerts yet, so a text like that may not be from your IT provider. Check with them before acting on it.

What does "Trusted Devices" protect against?

It shows every passkey, push-approved device, and PIN the system trusts for you. If you see something you don't recognize — revoke it, then change your password.

My child's school uses Shield and I haven't received an invite.

No invitation email is sent — the school adds you as a parent contact, and nothing is emailed to you. Sign in at the portal with Continue with Microsoft 365, or click Email me a sign-in link instead. If your account isn't recognised, ask your school's IT coordinator or counselor to add you.

I got MFA enrolled but lost my phone.

Use one of your saved recovery codes at the MFA prompt. If you didn't save them, contact your IT provider — they can reset MFA on your account.

Will my portal keep working if my company changes MSPs?

That's decided between MSPs. Your account can be migrated or deactivated. Your data remains under your MSP's control.

Troubleshooting

"Your account has been disabled." Your IT provider deactivated your account. Contact them to find out why and reactivate.

"MFA verification failed." Your phone's clock is out of sync (TOTP is time-based). Enable "Set time automatically" on your device. If you've lost the authenticator, use a recovery code, or ask your IT provider to reset MFA for you.

"Invalid invite" or "Invite link expired." No invitation link is ever sent — portal access is created by your IT provider, and you sign in yourself with a one-time sign-in link (valid 15 minutes) or your password. If you reached this from an old email, ignore it.

"This link has expired" on a password reset email. Reset links last 1 hour. Magic sign-in links last 15 minutes. Request a new one.

Sign-in loop. Your browser may be blocking cookies. Allow cookies for your portal's domain (e.g. support.yourcompany.com and app.theonestack.com). Try an Incognito / Private window to isolate.

"You don't have permission to view this section." Your user role doesn't include that feature. Ask your IT provider to upgrade your role.

Billing page shows no invoices. Either you don't have any yet, or your provider handles billing outside the portal (the Managed Billing banner explains this).

Cypher Training won't start. Open Training Dashboard and use the Security Training card. If the card isn't there, Cypher isn't enabled for your account. If it opens but there's nothing to start, you don't have a scheduled scenario yet. Check with your MSP.

I don't see my child's alerts (parent). Make sure your email matches the one the school registered for you and that your school has set up your parent access. If your child attends multiple schools using Shield, use the "Link to this school?" prompt that appears in the My Alerts view.

Can't update my payment method. Only Admins at your org can edit payment methods. Ask them, or contact your MSP if you're the only portal user for the account.

Push approval didn't arrive. Check that push notifications are enabled on your phone for the portal. Try removing and re-adding the device under Trusted Devices → Push-Enabled Devices.

"Security PIN is locked." Too many wrong PIN attempts. Wait for the lockout to expire (shown on the PIN screen) or ask your IT provider to reset it.

Portal looks broken or pages are blank. Hard refresh (Cmd/Ctrl-Shift-R), then clear site data from your browser devtools. Try another browser. If nothing works, open a support ticket describing what you saw and the page URL.

"Your account isn't linked to a school yet" (Shield school admin). Your MSP forgot to link your user to a client_id. Contact them to fix it.

My custom portal URL says "Site not found." DNS may not have propagated yet (allow up to 48 hours after first setup), or the custom-domain verification lapsed. Contact your MSP.