# Grant access

> To grant access to the support portal, create a role from the Customer support template and assign it to your support agents.

> For the complete documentation index, see [llms.txt](https://docs.talon.one/llms.txt).

Support agents assigned the **Customer support** role can access the support portal but
not the Campaign Manager. To enforce this, a support agent can't have other roles.

:::note
**Customer support** roles created before the release of the support portal are custom
roles. They keep their existing permissions but don't grant access to the support portal.
To recreate these legacy permissions without support portal access, create a
[custom role](/docs/product/account/account-settings/manage-roles.md#create-a-custom-role).
:::

Admin users retain access to both workspaces and can open the support portal directly via
the <Support className="icon"/> **Support portal** on the Campaign Manager's left-side
menu.

## Configure role permissions

The **Customer support** role has preset permissions. Configure these two settings when
granting access:

- **Application permissions**: Select the Applications the agents can access.
- **Loyalty program permissions**: Select specific programs and set a point limit to
  unlock the
  [**Loyalty** tab](/docs/support/support-agents/customer-profiles.md#loyalty-balances-and-history)
  on customer profiles.

The following table shows what each role can do in the support portal:

| Action                          | Customer support role | Admin role |
| ------------------------------- | --------------------- | ---------- |
| Search for records              | Yes                   | Yes        |
| Request a coupon or a gift card | Yes                   | Yes        |
| Add loyalty points              | Yes\*                 | Yes        |
| Deduct loyalty points           | Yes                   | Yes        |
| Approve or reject requests      | No                    | Yes        |

\*To add more points than the loyalty point limit, support agents create a request that an
admin user approves.

Admin users working in the support portal use the same request flow as support agents. To
generate coupons and gift cards directly without a request, admin users use the Campaign
Manager.

### Best practices for role provisioning

If you provision roles through
[single sign-on](/docs/product/account/account-settings/set-up-sso.md), support agents
keep access to the Campaign Manager.

When you provision the Customer support role, follow these best practices:

- Assign the role directly in the Campaign Manager, not through your identity provider.
- Set a loyalty point limit for each loyalty program so admin users review large point
  adjustments before they apply.
- Verify that the support agent can sign in to the support portal and can't open the Campaign Manager.

## Related pages

- [Support portal overview](/docs/support/overview.md)
- [Manage support requests](/docs/support/admins/manage-support-requests.md)