> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Multi-Tenancy

> Connect multiple tenants of the same integration — cross-mapping or strict isolation

## What multi-tenancy means here

Many vendor tools support multiple "tenants" — Azure AD with multiple directories, CrowdStrike with separate instances per business unit, ServiceNow per-customer instances, Intune separated by acquired companies. Protect can connect to all of them simultaneously.

A **tenant** in this sense is a vendor-side instance, not a Protect tenant (your whole Protect environment is one Protect tenant).

## When to use multi-tenancy

| Scenario                                        | Example                                           |
| ----------------------------------------------- | ------------------------------------------------- |
| **Acquired companies** with separate IT estates | Parent Azure AD + Acme Azure AD post-acquisition  |
| **Business units with separate tools**          | Corporate CrowdStrike + Manufacturing CrowdStrike |
| **MSP managing multiple customers**             | One ServiceNow per client                         |
| **Regional separation**                         | EMEA Intune + APAC Intune                         |
| **Compliance segregation**                      | PCI-scope environment separated from corporate    |

## Enabling multi-tenancy

<Steps>
  <Step title="Connect the first tenant normally">
    [Settings → Integrations](/settings/integrations) → integration → Connect — set up your primary tenant.
  </Step>

  <Step title="Click Modify on the connected integration">
    On the integration card.
  </Step>

  <Step title="Toggle Enable Multi-Tenant">
    Or **Enable Multi-Tenancy**, depending on integration. A new section appears for additional tenants.
  </Step>

  <Step title="Add additional tenants">
    Click **Add New Tenant**:

    * **Tenant name** — friendly identifier for your reference
    * **Authentication** — complete the connection flow for the new tenant

    Repeat for each tenant.
  </Step>

  <Step title="Wait for sync">
    Each new tenant runs a full initial sync.
  </Step>
</Steps>

## Tenant naming

Tenant names are for *your* benefit — they identify which tenant a device or user comes from in:

* Column Editor (tenant column available)
* Saved views (filter by tenant)
* Dashboard panels (per-tenant breakdown where supported)
* Reports

Naming patterns:

| Pattern          | Example names                                    |
| ---------------- | ------------------------------------------------ |
| By domain        | `Primary Domain`, `Acme Subsidiary`, `EU Domain` |
| By business unit | `Corporate IT`, `Manufacturing`, `R&D`           |
| By region        | `North America`, `EMEA`, `APAC`                  |
| By client (MSP)  | `Client-Acme`, `Client-Bravo`, `Client-Charlie`  |
| By environment   | `Production`, `Lab`, `Acquisition-Integration`   |

## Cross-mapping modes

Multi-tenancy has two modes:

<Tabs>
  <Tab title="Cross-mapping (default)">
    **How it works:** Any tenant of Integration A can match to any tenant of Integration B. Devices are deduplicated across all tenants.

    **Example:** A laptop registered in Azure AD tenant "Acme" can be matched and fused with a CrowdStrike record from tenant "Corporate" if hardware identifiers align.

    **Best for:**

    * Single organisations with multiple instances (acquisitions, regional)
    * Merged environments where the same physical devices appear in multiple tools' tenants
    * Most use cases — this is the right default
  </Tab>

  <Tab title="Tenant isolation (strict)">
    **How it works:** Tenant A only matches to Tenant A. No deduplication across tenant boundaries. Complete data isolation.

    **Example:** A laptop in Acme's CrowdStrike tenant cannot fuse with a laptop in Bravo's CrowdStrike tenant, even if they appear identical.

    **Best for:**

    * MSPs / MSSPs managing multiple customers
    * Organisations with truly separate toolsets and no overlap
    * Post-acquisition with no IT integration
    * Environments with strict data-separation requirements (regulated industries)

    <Warning>
      Tenant isolation must be enabled by ThreatAware support. Contact your account team to switch to this mode.
    </Warning>
  </Tab>
</Tabs>

## Filtering by tenant

Once multi-tenancy is enabled, every device record carries its source tenant. Filtering by tenant in the device grid uses the standard [query language](/query-language) with the `:` operator (not `=`). The exact field path depends on which integration you're filtering — open the Devices search bar autocomplete and start typing `tenant` or your integration prefix to discover the live field name in your tenant.

For multi-condition tenant filters, compose with `AND` / `OR` / `NOT` — there is no `IN (…)` operator.

The tenant attribute is also available in the column editor, the Logic Engine, saved views, and Studio.

## MSP / MSSP pattern

For an MSP managing 20 clients:

1. Enable multi-tenancy on every integration where clients have separate instances
2. Use **strict tenant isolation** mode
3. Create per-client [tags](/settings/tags) that look like `tags:Client-Acme` driven by tenant match
4. Create per-client [Teams](/settings/teams)
5. Create per-client [custom roles](/settings/roles) with data filter `tags:Client-Acme`
6. Build per-client [Reporting apps](/reporting) with company branding
7. Schedule per-client [reports](/scheduled-reports)

Each technician sees only their assigned clients; the MSP itself can see cross-client roll-ups from a Super Admin account.

## Limitations

<Warning>
  **Tenant counts vary by license.** Tenant-isolated multi-tenancy is typically available on higher tiers. Check with your account manager.
</Warning>

<Warning>
  **Some integrations don't support multi-tenant.** A small number of vendor APIs are single-tenant by design. The Modify dialog will hide the toggle in that case.
</Warning>

## See also

<CardGroup cols={3}>
  <Card title="Integrations" icon="plug" href="/integrations">
    Conceptual overview
  </Card>

  <Card title="Settings → Integrations" icon="gear" href="/settings/integrations">
    Where to enable
  </Card>

  <Card title="Access Control" icon="users-gear" href="/access-control">
    MSP role design
  </Card>
</CardGroup>