Invite staff and set roles

In People and access send an invitation and choose the appropriate roles. Grant the smallest set of permissions that is enough for the work. For an agent role, check the impact on paid seats.

Customers is a separate list — they have portal access, but not the console, and they do not take paid seats.

To revoke access: deactivate the membership. In an emergency, also revoke active sessions.

Do not share the administrator account. Require multi-factor authentication from anyone with access to settings.