Skip to main content

​
What multi-tenancy means here

Many vendor tools support multiple “tenants” — Azure AD with multiple directories, CrowdStrike with separate instances per business unit, ServiceNow per-customer instances, Intune separated by acquired companies. Protect can connect to all of them simultaneously. A tenant in this sense is a vendor-side instance, not a Protect tenant (your whole Protect environment is one Protect tenant).

​
When to use multi-tenancy

​
Enabling multi-tenancy

1

Connect the first tenant normally

Settings → Integrations → integration → Connect — set up your primary tenant.
2

Click Modify on the connected integration

On the integration card.
3

Toggle Enable Multi-Tenant

Or Enable Multi-Tenancy, depending on integration. A new section appears for additional tenants.
4

Add additional tenants

Click Add New Tenant:
  • Tenant name — friendly identifier for your reference
  • Authentication — complete the connection flow for the new tenant
Repeat for each tenant.
5

Wait for sync

Each new tenant runs a full initial sync.

​
Tenant naming

Tenant names are for your benefit — they identify which tenant a device or user comes from in:
  • Column Editor (tenant column available)
  • Saved views (filter by tenant)
  • Dashboard panels (per-tenant breakdown where supported)
  • Reports
Naming patterns:

​
Cross-mapping modes

Multi-tenancy has two modes:
How it works: Any tenant of Integration A can match to any tenant of Integration B. Devices are deduplicated across all tenants.Example: A laptop registered in Azure AD tenant “Acme” can be matched and fused with a CrowdStrike record from tenant “Corporate” if hardware identifiers align.Best for:
  • Single organisations with multiple instances (acquisitions, regional)
  • Merged environments where the same physical devices appear in multiple tools’ tenants
  • Most use cases — this is the right default

​
Filtering by tenant

Once multi-tenancy is enabled, every device record carries its source tenant. Filtering by tenant in the device grid uses the standard query language with the : operator (not =). The exact field path depends on which integration you’re filtering — open the Devices search bar autocomplete and start typing tenant or your integration prefix to discover the live field name in your tenant. For multi-condition tenant filters, compose with AND / OR / NOT — there is no IN (…) operator. The tenant attribute is also available in the column editor, the Logic Engine, saved views, and Studio.

​
MSP / MSSP pattern

For an MSP managing 20 clients:
  1. Enable multi-tenancy on every integration where clients have separate instances
  2. Use strict tenant isolation mode
  3. Create per-client tags that look like tags:Client-Acme driven by tenant match
  4. Create per-client Teams
  5. Create per-client custom roles with data filter tags:Client-Acme
  6. Build per-client Reporting apps with company branding
  7. Schedule per-client reports
Each technician sees only their assigned clients; the MSP itself can see cross-client roll-ups from a Super Admin account.

​
Limitations

Tenant counts vary by license. Tenant-isolated multi-tenancy is typically available on higher tiers. Check with your account manager.
Some integrations don’t support multi-tenant. A small number of vendor APIs are single-tenant by design. The Modify dialog will hide the toggle in that case.

​
See also

Integrations

Conceptual overview

Settings → Integrations

Where to enable

Access Control

MSP role design