Skip to main content

​
What multi-tenancy means here

Many vendor tools support multiple “tenants” — Azure AD with multiple directories, CrowdStrike with separate instances per business unit, ServiceNow per-customer instances, Intune separated by acquired companies. ThreatAware can connect to all of them simultaneously. A tenant in this sense is a vendor-side instance, not a ThreatAware tenant (your whole ThreatAware environment is one ThreatAware tenant).

​
When to use multi-tenancy

​
Enabling multi-tenancy

1

Connect the first tenant normally

Settings → Integrations → integration → Connect — set up your primary tenant.
2

Enable multi-tenancy

Hover over the integration’s card, click Modify, then Enable Multi-Tenancy. The card then shows how many tenants it has, such as 2 tenants, instead of CONNECTED.
3

Add more tenants

Click the tenant count to list the tenants, each with its own status, then click + Add Tenant. Give the tenant a name you’ll recognise, and complete the connection for it. Repeat for each tenant.
4

Wait for sync

Each new tenant runs a full initial sync.

​
Tenant naming

Tenant names are for your benefit — they identify which tenant a device or user comes from in:
  • Column Editor (tenant column available)
  • Saved views (filter by tenant)
  • Dashboard panels (per-tenant breakdown where supported)
  • Reports
Naming patterns:

​
Cross-mapping modes

Multi-tenancy has two modes:
How it works: Any tenant of Integration A can match to any tenant of Integration B. Devices are deduplicated across all tenants.Example: A laptop registered in Azure AD tenant “Acme” can be matched and fused with a CrowdStrike record from tenant “Corporate” if hardware identifiers align.Best for:
  • Single organisations with multiple instances (acquisitions, regional)
  • Merged environments where the same physical devices appear in multiple tools’ tenants
  • Most use cases — this is the right default

​
Filtering by tenant

Once multi-tenancy is enabled, every device record carries its source tenant. Filtering by tenant in the device grid uses the standard query language with the : operator (not =). The exact field path depends on which integration you’re filtering — open the Devices search bar autocomplete and start typing tenant or your integration prefix to discover the live field name in your tenant. For multi-condition tenant filters, compose with AND / OR / NOT — there is no IN (…) operator. The tenant attribute is also available in the column editor, the Logic Engine, saved views, and Studio.

​
MSP / MSSP pattern

For an MSP managing 20 clients:
  1. Enable multi-tenancy on every integration where clients have separate instances
  2. Use strict tenant isolation mode
  3. Create per-client tags that look like tags:Client-Acme driven by tenant match
  4. Create per-client Teams
  5. Create per-client custom roles with Device Visibility set to Selected tags, such as Client-Acme
  6. Build per-client Reporting apps with company branding
  7. Schedule per-client reports
Each technician sees only their assigned clients; the MSP itself can see cross-client roll-ups from a Super Admin account.

​
Limitations

Tenant counts vary by license. Tenant-isolated multi-tenancy is typically available on higher tiers. Check with your account manager.
Some integrations don’t support multi-tenant. A small number of vendor APIs are single-tenant by design. The Modify dialog will hide the toggle in that case.

​
See also

Integrations

Conceptual overview

Settings → Integrations

Where to enable

Access Control

MSP role design