Press CTRL+K to open search

Limiting access to a tenant group

  • 4 minute(s) read
Prev Next

Overview

This tutorial shows you how to add a user to Tenant Manager and limit their access to one tenant group. You finish by checking that the user can reach only that tenant group and the tenants inside it.

Business value

Limiting a user to one tenant group keeps unrelated tenants out of reach, for example when a regional team works only on its own tenants. The user can still do their work in the part of the tree you chose, with no more access than the role gives.

Prerequisites

Before you start, make sure the tenant group you want to share exists in the tree. If you still need to create it, see Managing tenant groups. If none of the built-in roles fits, create a custom role first. See Roles and permissions in Tenant Manager.

Required permissions

You need the Manage users permission. The Owner role includes it, and the Contributor and Reader roles do not. A custom role with Manage users can add users and assign existing roles. In the tree, you can grant access only on the tenant groups and tenants where you can manage users. For details, see Roles and permissions in Tenant Manager.

How it works

A user can have one role for the whole module, or access limited to chosen tenant groups and tenants. When you limit access, you grant a tenant group and choose a role for it. The grant and the role copy down to every nested tenant group and tenant beneath it.

The assignment nearest to a tenant group or tenant decides what the user can do there. Parent tenant groups that the user cannot access still appear in their tree, grayed out and not selectable.

Steps

You add and limit a user in User management, and then you check the result. You start in Tenant Manager with the tree view open. In the sidebar header, select the gear icon, and then select User management.

Add the user and grant the tenant group

This procedure adds the user and gives them a role on one tenant group.

  1. On the Users tab, select Add user.
  2. Identify the person. For a new user, enter the First name, Last name, and Email address. For an existing user, select the user from the list.
  3. Under Role assignment, choose Specify custom permissions. Direct role assignment gives one role for the whole module, so do not choose it here.
  4. In the tree, turn on the switch in the Revoke / Grant access column for the tenant group.
  5. In the Role column, choose a role for the tenant group. The role defaults to Reader, and Owner is not offered.
  6. Select Done to close the permissions dialog.
  7. Select Add.

Tenant Manager shows "User added to Tenant Manager successfully".

The role you choose in step 5 decides what the user can do in that tenant group. Reader can view only. Contributor can also add, edit, sync, move, and delete tenants in it, and create, edit, move, and delete tenant groups in it. Adding a tenant directly to the top-level tenant group needs access to the whole module, so a role limited to one tenant group can't do it.

Verify the access

This procedure confirms that the user has access to the tenant group and nothing else.

  1. In the tree view, open the context menu ( ⋮ ) of the tenant group, and select Security > Users. Check that the user is listed. This list shows only the users who have access to that tenant group.
  2. Ask the user to open Tenant Manager. They can open the tenant group and its tenants. Parent tenant groups appear grayed out and cannot be selected.

To change the role or the scope later, open the Users tab, select Edit permission for the user, change Role assignment, and select Update.

Note:

You can also grant access from the context menu of a tenant group or tenant. Select Security > Users, and then select Assign user role or Assign group role. With Assign user role, the role defaults to Contributor. Check the role before you save in either dialog.

Troubleshooting

Use these items when you cannot finish the steps or the user sees the wrong access.

  1. The Specify custom permissions area shows "Get started with Tenant Manager to specify custom permissions."
    Cause: Tenant Manager has no tenant group tree yet, because no tenant is connected.
    Fix: connect your first tenant from the Home page. See Connect a Microsoft 365 tenant.

  2. The switch for a tenant group is disabled.
    Cause: your role does not include Manage users on that tenant group. The tree shows "You can not manage users in this group", or the same message for a tenant.
    Fix: ask a module owner to grant you Manage users at that scope, or to add the user for you.

  3. The user sees a parent tenant group grayed out and cannot select it.
    Cause: parent tenant groups appear in the user's tree only because the user has access to something beneath them.
    Fix: no action is needed. If the user needs the parent tenant group itself, select Edit permission for the user and grant it.

  4. The user sees "This group is outside your Tenant Manager access." or "This tenant is outside your Tenant Manager access."
    Cause: the user tried to act on a tenant group or tenant outside the access you granted.
    Fix: if the user needs it, select Edit permission for the user and grant that tenant group or tenant.

Related articles