11---
2- title : Multi Tenancy
2+ title : Multi-tenancy
33taxonomy :
44 category : docs
55 label : reference
66---
77
8- !!!!! Multi Tenancy is only available in the Mender Enterprise plan.
8+ !!!!! Multi-tenancy is only available in the Mender Enterprise plan.
99!!!!! See [ the Mender plans page] ( https://mender.io/pricing/plans?target=_blank )
1010!!!!! for an overview of all Mender plans and features.
1111
1212## Introduction
1313
14- Multi Tenancy is a feature that allows multiple tenants (organizations or teams)
14+ Multi-tenancy is a feature that allows multiple tenants (organizations or teams)
1515to share a single Mender server infrastructure while keeping their data, users, and
1616devices isolated from each other. This is especially useful in enterprise environments
1717where different departments or clients need separate management but can benefit from a
1818centralized deployment and update management system.
1919
2020
21- ## High-Level Overview
21+ ## High-level overview
2222
23- Mender's Multi Tenancy feature ensures that different tenants have completely separate
23+ Mender's multi-tenancy feature ensures that different tenants have completely separate
2424environments, meaning that each tenant has their own set of users, devices, and device
2525groups, and only the users associated with a tenant can access its data. This enables
2626centralized device management at scale across multiple teams or organizations without
2727compromising on security or data privacy.
2828
29- Additionally, thanks to the SSO support in Mender Enterprise, it is possible to
30- ensure that only users authenticated by the organization's Identity Provider can
31- access any Mender Tenant .
29+ Additionally, thanks to the single sign-on ( SSO) support in Mender Enterprise, it is possible to
30+ ensure that only users authenticated by the organization's Identity Provider (IdP) can
31+ access any Mender tenant .
3232
3333
3434## Tenant isolation
3535
36- Mender achieves multi tenancy by logically partitioning the platform's resources so
36+ Mender achieves multi- tenancy by logically partitioning the platform's resources so
3737that multiple tenants can use the same underlying infrastructure without interfering
3838with one another. This setup helps organizations reduce overhead and operational costs,
3939as they don't need to set up and maintain separate servers for each department or
4040customer.
4141
42- Every microservice stores the information about all the Tenants in a single database,
43- and every record includes the Tenant ID. When retrieving information from the database,
44- the server filters the records by Tenant ID and returns the data belonging to the
45- specific Tenant the user or the device belongs to. Similarly, the Mender artifacts
42+ Every microservice stores the information about all the tenants in a single database,
43+ and every record includes the tenant ID. When retrieving information from the database,
44+ the server filters the records by tenant ID and returns the data belonging to the
45+ specific tenant the user or the device belongs to. Similarly, the Mender artifacts
4646are stored in a common storage account (Azure Blob Storage or AWS S3 bucket) and
47- prefixed by the Tenant ID. It is also possible to configure a Tenant specific
47+ prefixed by the tenant ID. It is also possible to configure a tenant specific
4848object store for the artifacts if needed.
4949
50- Individual billing may be addressed on the Tenant level: Mender Server tracks resource
51- usage (such as device limits and consumption) per Tenant , enabling cost management
50+ Individual billing may be addressed on the tenant level: the Mender Server tracks resource
51+ usage (such as device limits and consumption) per tenant , enabling cost management
5252across different clients or teams.
5353
54- The Mender Server provides monitoring and audit logs capabilities at the Tenant level,
55- allowing each Tenant to monitor its own devices and audit logs without visibility
56- into other Tenants ' environments.
54+ The Mender Server provides monitoring and audit logs capabilities at the tenant level,
55+ allowing each tenant to monitor its own devices and audit logs without visibility
56+ into other tenants ' environments.
5757
5858
59- ## Typical Use Cases for Multi Tenancy in Mender
59+ ## Typical use cases for multi-tenancy in Mender
6060
6161The typical use cases for this feature are:
6262
63- 1 . * Large Enterprises with Multiple Divisions * : Organizations that have several
63+ 1 . * Large Enterprises with multiple divisions * : Organizations that have several
6464departments, subsidiaries, or teams working on different projects can use Mender
6565Server to isolate device management for each division. For example, an organization
66- with multiple Business Units focusing on different verticals can keep each Business
66+ with multiple business units focusing on different verticals can keep each Business
6767Unit and their product lines isolated.
6868
69693 . * OEMs (Original Equipment Manufacturers)* : OEMs can manage a customer's
70- environment by adding a user into their Tenant , or they can let a customer
70+ environment by adding a user into their tenant , or they can let a customer
7171manage their devices and OTA fully themselves, completely isolated from the OEM.
7272
73- 4 . * Test and Production Environments * : Multi Tenancy can also be used internally
73+ 4 . * Test and production environments * : Multi-tenancy can also be used internally
7474to separate different environments, such as test, staging, and production
7575environments. Each environment can have its own set of devices and updates to
7676ensure that no test data interferes with production systems.
@@ -80,50 +80,50 @@ ensure that no test data interferes with production systems.
8080
8181![ Service Provider] ( service-provider.png )
8282
83- In Mender Server Enterprise, Multi Tenancy is managed by a special type of Tenant
84- called Service Provider Tenant (or SP Tenant) .
83+ In Mender Server Enterprise, multi-tenancy is managed by a special type of tenant
84+ called the Service Provider Tenant.
8585
86- Service Provider Tenant acts as a central point of control for all the children
87- Tenants allowing for organisation wide definition of policies applicable to all
88- children Tenants (i.e. SSO and features available to child tenants).
86+ The Service Provider Tenant acts as a central point of control for all the child
87+ tenants allowing for organisation wide definition of policies applicable to all
88+ child tenants (i.e. SSO and features available to child tenants).
8989
90- The SP Tenant can:
90+ The Service Provider Tenant can:
9191
92- - Create a child Tenant : Admin users can create multiple Tenants through the
93- Mender Enterprise UI or the Management APIs. Each Tenant is assigned a unique
94- Tenant ID, Tenant Token and initial administrative account.
92+ - Create a child tenant : Admin users can create multiple tenants through the
93+ Mender Enterprise UI or the Management APIs. Each tenant is assigned a unique
94+ tenant ID, tenant token and initial administrative account.
9595
96- - User Management: SP Tenant administrators can create an initial admin for a child
97- Tenant which will be responsible for assigning different roles and permissions
98- within the child Tenant intself, ensuring proper access control. Each child
99- Tenant's users only have access to devices and groups within their own Tenant .
100- Optionally, SP Tenant Admins can enable SSO for the children Tenants inheriting
96+ - User management: Service Provider Tenant administrators can create an initial admin for a child
97+ tenant which will be responsible for assigning different roles and permissions
98+ within the child tenant intself, ensuring proper access control. Each child
99+ Tenant's users only have access to devices and groups within their own tenant .
100+ Optionally, Service Provider Tenant admins can enable SSO for the child tenants inheriting
101101 the configuration from the Service Provider Tenant and map users to specific
102102 tenants; this way, only users from the organization's Identity Provider can log
103- in to the Mender Server accessing the correct Tenant based on their needs.
103+ in to the Mender Server accessing the correct tenant based on their needs.
104104
105- - Device limit: Set and change device limit of all children Tenants . Allocates
106- the overall Device limit of to children Tenants .
105+ - Device limit: Set and change device limit of all child tenants . Allocates a number of devices
106+ from the overall device limit to child tenants .
107107
108108
109- ## How to enable Multi Tenancy
109+ ## How to enable multi-tenancy
110110
111111If you are using hosted Mender Enterprise please
112- [ contact us] ( https://mender.io/contact-us ) for help with migration to a multi
113- tenant setup using the Service Provider Tenant. For existing Tenants with a
112+ [ contact us] ( https://mender.io/contact-us ) for help with migration to a multi-tenant
113+ setup using the Service Provider Tenant. For existing tenants with a
114114more complex configuration it may be treated as a
115115[ Consulting project] ( https://mender.io/pricing/mender-extras ) .
116116
117- For on-premise installations, you can promote an existing Tenant to a Service Provider Tenant with the following command:
117+ For on-premise installations, you can promote an existing tenant to a Service Provider Tenant with the following command:
118118
119119``` bash
120120TENANTID=your-tenant-id-here
121121tenantadm update-tenant --id " ${TENANTID} " --service-provider
122122```
123123
124- where ` TENANTID ` variable holds the ID of the Tenant to promote.
124+ where ` TENANTID ` variable holds the ID of the tenant to promote.
125125Please note, you have to execute the above command from the inside of the ` tenantadm `
126- container. For on-premise installations you can find the Tenant ID by listing the Tenants using the following command:
126+ container. For on-premise installations you can find the tenant ID by listing the tenants using the following command:
127127
128128``` bash
129129# tenantadm list-tenants | grep -v loading | jq '.[] | { "tenant id": .id, "tenant name":.name}'
@@ -139,13 +139,13 @@ container. For on-premise installations you can find the Tenant ID by listing th
139139
140140## Service Provider Tenant in the Mender UI
141141
142- ### Managing Tenants
142+ ### Managing tenants
143143
144- After you log in to the Tenant that is a Service Provider, you will see an empty tenants list:
144+ After you log in to the Service Provider Tenant , you will see an empty tenants list:
145145
146146![ Service provider main view empty] ( sp0.png )
147147
148- Starting here you can add a new Tenant :
148+ Starting here you can add a new tenant :
149149
150150![ Service provider add] ( sp0-add.png )
151151
@@ -157,7 +157,7 @@ Now there are additional operations you can perform on it, by clicking the detai
157157
158158![ Service provider add] ( sp1-edit.png )
159159
160- As you can see, the Mender UI allows the Service Provider Tenant to manage the children Tenants .
160+ As you can see, the Mender UI allows the Service Provider Tenant to manage the child tenants .
161161Every operation is recorded in the audit logs:
162162
163163![ Service provider add] ( sp2.png )
0 commit comments