IN THIS ARTICLE


Overview

Restricted workspaces control access to sensitive information settings, commonly by teams such as HR, Finance, or Legal. When a workspace is marked as restricted, account-wide admins are automatically removed from it, preventing them from updating configurations or accessing data without the workspace teams’ permission.

Workspace restrictions do not affect the visibility of published settings such as service items or solution articles. Visibility is managed separately through the visibility settings.


While this enhances data privacy, it also introduces a potential risk: if no one within the workspace has full access to both data and administrative settings, teams lose the ability to manage workflows, troubleshoot issues, or update configurations.     For example, if a workflow in a restricted HR workspace fails and no agent has the necessary permissions to access both ticket data and module settings, resolving the issue becomes impossible, and may even require the intervention of Freshservice's support team. This results in operational delays and increased dependency.

To prevent such scenarios, each restricted workspace must have at least one Workspace Manager. Workspace Managers are licensed agents who are granted full access to both settings and data within their assigned workspace. These managers ensure continuity in workspace administration and can be easily identified from within the workspace as well as through global settings. This role-based solution empowers individual teams to operate securely and independently.

What additional access does a Workspace Manager have?

The access granted to a Workspace Manager depends on whether the workspace is restricted or unrestricted:

  • In unrestricted workspaces, Workspace Managers do not receive any additional access beyond what is provided by their assigned role. However, assigning Workspace Managers helps Global Admins identify key owners or leaders for each workspace. It is considered best practice to designate Workspace Managers, even if the workspace is unrestricted.

  • In restricted workspaces, Workspace Managers have one additional privilege: only they can unrestrict the workspace. Other users can access workspace settings and data based on their assigned roles and permissions, but they cannot change the restriction status.

Who can be a Workspace Manager?

A Workspace Manager must be a licensed agent, either an IT or Business Agent. 

  • IT Agent – Assigned roles are Workspace Admin and IT Team Supervisor

  • Business Agent – Assigned roles are Workspace Admin and Business Team Supervisor/IT Team Supervisor

Business agents cannot be assigned as Workspace Managers in IT-type workspaces because they cannot be granted administrative access in those workspaces.



When are Workspace Managers assigned?

  • During workspace creation, the creator is assigned as a Workspace Manager by default. Learn more
  • When converting a workspace to restricted, if no Workspace Manager exists, the system enforces you to assign one.
  • Manually, Admins can add managers at any time through the workspace's agent management page. Learn more
  • During license updates, Freshservice ensures that at least one Workspace Manager is retained automatically.

How to add a Workspace Manager during workspace creation?

Perform the following steps to add a workspace manager:

  1. Navigate to the Global Settings > Manage Workspace.

  2. In the new screen that appears, click Create workspace.

  3. Next, you need to select the template based on whether you want to create an IT or Business workspace.

  4. In the workspace creation screen that appears, after providing other details like the workspace name, pre-fill the workspace with sample data and ticket types. Under Workspace managers, select agents to add as Workspace managers. 

    Note: Business agents will not appear in the Workspace Manager dropdown if the selected template is of type IT, as they cannot be assigned administrative access in IT workspaces.

  5. Click Create to complete the process. Freshservice automatically assigns appropriate roles as below.

    • IT Agent → Workspace Admin + IT Supervisor

    • Business Agent → Workspace Admin + Business Team Supervisor

How to add Workspace Managers from the Manage Workspace screen

Admins with access can navigate to the Workspace Settings page within a workspace to view or assign Workspace Managers.

For unrestricted workspaces, assigning a Workspace Manager is optional. If no manager is assigned, the Workspace Managers section will display a message indicating that none are currently added. Assigning one is recommended as a best practice to identify workspace ownership, but it becomes mandatory only when the workspace is restricted.


To add managers from the Manager Workspace screen, perform the following steps:

  1. In the Workspace Managers section, click + Add Workspace Managers.

  2. In the new screen that appears, under Users, find the agent you want to assign as a workspace manager and then click Add.

  3. To review an agent’s assigned roles, click their name in the list.

Global Admins can view all assigned Workspace Managers across every workspace by navigating to Global Settings > Manage Workspaces. This provides a centralized view of workspace ownership.


FAQs and Best Practices for Workspace Managers

1. Do all restricted workspaces need a Workspace Manager?

Yes. Every restricted workspace must have at least one Workspace Manager with full access to workspace settings and data (based on their license type). This ensures the workspace remains independently manageable and compliant.

2. Is Workspace Manager a new role?

No. Workspace Manager is not a separate role—it is a status assigned to an agent within a workspace when they are granted one of the following roles:

  • IT workspaces: Supervisor or Administrator

  • Business workspaces: Full Access

This status helps identify key workspace owners but does not provide additional permissions beyond those of the assigned role.

3. What can a Workspace Manager do that other agents cannot?

While all agents can access workspace settings based on their assigned permissions, only Workspace Managers can unrestrict a restricted workspace.

Additionally, assigning Workspace Managers helps Global Admins easily identify workspace owners for operational clarity and accountability.

4. Can I remove or downgrade the only Workspace Manager in a restricted workspace?

No. You must first assign another Workspace Manager before removing or downgrading the current one. This safeguard ensures the workspace always has a designated owner with the necessary permissions.

5. What happens if I change a Workspace Manager’s license from IT to Business?

  • If the workspace is a Business workspace, the user can continue as a Workspace Manager.

  • If the workspace is an IT workspace:

    • If there are multiple admins, the user will be demoted to Workspace Agent and lose admin roles.

    • If the user is the sole Workspace Manager, the license change will be blocked until a new manager is assigned.

6. What happens if I change a Workspace Manager’s license from Business to IT?

  • If there are multiple admins, the user will be demoted to Workspace Agent unless they have both the Workspace Admin and IT Team Supervisor roles.

  • If the user is the sole Workspace Manager, the system will automatically change their Business Team Supervisor role to IT Team Supervisor so they can retain manager status.

7. What happens to Workspace Managers during a downgrade from Pro/Enterprise to Start/Growth plans?

  • If the sole Workspace Manager is a business agent, and the downgrade removes necessary features or role support, the system will prompt you to assign a new eligible manager.

  • If no replacement is assigned, the downgrade will be blocked to ensure the workspace has a manager.

8. Can I reduce the data or agent scope of a Workspace Manager?

Yes. Even though Workspace Managers are assigned roles like IT Team Supervisor or Business Team Supervisor (which provide access to all modules), their data and agent scope can be limited to:

  • Items assigned to them

  • Specific agent groups

Note: Workspace Managers cannot access restricted group data unless they are members of that group.

9. Who can unrestrict a workspace?

Only Workspace Managers can change a workspace from restricted to unrestricted.

10. Where can I see who the Workspace Managers are?

Workspace Manager tags are visible only within the Workspace Settings. They are not displayed on the agent’s profile or in the Roles section.

11. What if I try to remove the last Workspace Manager using API or import?

Such actions will be blocked. The system returns an error indicating that restricted workspaces must retain at least one Workspace Manager. If all managers are removed or demoted in bulk, the system blocks the action for the last remaining manager.

12. Can Business Agents be Workspace Managers in IT workspaces?

No. Business Agents cannot manage IT workspaces. Their access is limited by license type, and they cannot be granted administrative permissions in IT-type workspaces.

13. Who is considered a Workspace Agent?

A Workspace Agent is any user in the workspace who does not have both:

  • The Workspace Admin role

  • The IT Team Supervisor or Business Team Supervisor role (depending on workspace type)

Note: Custom roles are not used to determine Workspace Manager status. This means an agent with a custom role and full access could still be considered a Workspace Agent if not explicitly marked as a manager. It's the responsibility of Workspace Admins to assign users appropriately in the Manage Workspace section.

14. What happens if I assign Workspace Manager roles to a Workspace Agent?

If a Workspace Agent is given one of the qualifying roles (Supervisor, Administrator, or Full Access), the system will automatically elevate their status to Workspace Manager. If done through the user interface, the admin will be informed that the user is now a Workspace Manager.