--- title: "Limiting access to a tenant group" slug: "limiting-access-to-a-tenant-group-in-tenant-manager" updated: 2026-11-02T06:53:54Z published: 2026-11-02T06:53:54Z canonical: "docs.turbo360.com/limiting-access-to-a-tenant-group-in-tenant-manager" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.turbo360.com/llms.txt > Use this file to discover all available pages before exploring further. # Limiting access to a tenant group ## Overview This tutorial shows you how to add a user to Tenant Manager and limit their access to one tenant group. You finish by checking that the user can reach only that tenant group and the tenants inside it. ### Business value Limiting a user to one tenant group keeps unrelated tenants out of reach, for example when a regional team works only on its own tenants. The user can still do their work in the part of the tree you chose, with no more access than the role gives. ## Prerequisites Before you start, make sure the tenant group you want to share exists in the tree. If you still need to create it, see [Managing tenant groups](https://docs.turbo360.com/docs/managing-groups-in-tenant-manager). If none of the built-in roles fits, create a custom role first. See [Roles and permissions in Tenant Manager](https://docs.turbo360.com/docs/tenant-manager-roles-and-permissions). ### Required permissions You need the **Manage users** permission. The **Owner** role includes it, and the **Contributor** and **Reader** roles do not. A custom role with **Manage users** can add users and assign existing roles. In the tree, you can grant access only on the tenant groups and tenants where you can manage users. For details, see [Roles and permissions in Tenant Manager](https://docs.turbo360.com/docs/tenant-manager-roles-and-permissions). ## How it works A user can have one role for the whole module, or access limited to chosen tenant groups and tenants. When you limit access, you grant a tenant group and choose a role for it. The grant and the role copy down to every nested tenant group and tenant beneath it. The assignment nearest to a tenant group or tenant decides what the user can do there. Parent tenant groups that the user cannot access still appear in their tree, grayed out and not selectable. ## Steps You add and limit a user in **User management**, and then you check the result. You start in Tenant Manager with the tree view open. In the sidebar header, select the gear icon, and then select **User management**. ### Add the user and grant the tenant group This procedure adds the user and gives them a role on one tenant group. 1. On the **Users** tab, select **Add user**. 2. Identify the person. For a new user, enter the **First name**, **Last name**, and **Email address**. For an existing user, select the user from the list. 3. Under **Role assignment**, choose **Specify custom permissions**. **Direct role assignment** gives one role for the whole module, so do not choose it here. 4. In the tree, turn on the switch in the **Revoke / Grant access** column for the tenant group. 5. In the **Role** column, choose a role for the tenant group. The role defaults to Reader, and Owner is not offered. 6. Select **Done** to close the permissions dialog. 7. Select **Add**. Tenant Manager shows "User added to Tenant Manager successfully". The role you choose in step 5 decides what the user can do in that tenant group. Reader can view only. Contributor can also add, edit, sync, move, and delete tenants in it, and create, edit, move, and delete tenant groups in it. Adding a tenant directly to the top-level tenant group needs access to the whole module, so a role limited to one tenant group can't do it. ### Verify the access This procedure confirms that the user has access to the tenant group and nothing else. 1. In the tree view, open the context menu ( ⋮ ) of the tenant group, and select **Security** > **Users**. Check that the user is listed. This list shows only the users who have access to that tenant group. 2. Ask the user to open Tenant Manager. They can open the tenant group and its tenants. Parent tenant groups appear grayed out and cannot be selected. To change the role or the scope later, open the **Users** tab, select **Edit permission** for the user, change **Role assignment**, and select **Update**. Note: You can also grant access from the context menu of a tenant group or tenant. Select **Security** > **Users**, and then select **Assign user role** or **Assign group role**. With **Assign user role**, the role defaults to Contributor. Check the role before you save in either dialog. ## Troubleshooting Use these items when you cannot finish the steps or the user sees the wrong access. 1. **The Specify custom permissions area shows "Get started with Tenant Manager to specify custom permissions."** Cause: Tenant Manager has no tenant group tree yet, because no tenant is connected. Fix: connect your first tenant from the **Home** page. See [Connect a Microsoft 365 tenant](https://docs.turbo360.com/docs/connect-a-microsoft-365-tenant). 2. **The switch for a tenant group is disabled.** Cause: your role does not include **Manage users** on that tenant group. The tree shows "You can not manage users in this group", or the same message for a tenant. Fix: ask a module owner to grant you **Manage users** at that scope, or to add the user for you. 3. **The user sees a parent tenant group grayed out and cannot select it.** Cause: parent tenant groups appear in the user's tree only because the user has access to something beneath them. Fix: no action is needed. If the user needs the parent tenant group itself, select **Edit permission** for the user and grant it. 4. **The user sees "This group is outside your Tenant Manager access." or "This tenant is outside your Tenant Manager access."** Cause: the user tried to act on a tenant group or tenant outside the access you granted. Fix: if the user needs it, select **Edit permission** for the user and grant that tenant group or tenant. ## Related articles - [Roles and permissions in Tenant Manager](https://docs.turbo360.com/docs/tenant-manager-roles-and-permissions) - [Managing tenant groups](https://docs.turbo360.com/docs/managing-groups-in-tenant-manager) - [Understanding tenant groups](https://docs.turbo360.com/docs/understanding-groups-and-tenants) - [Access and permission strategy](https://docs.turbo360.com/docs/access-and-permission-strategy-in-tenant-manager) - [Tenant group design](https://docs.turbo360.com/docs/tenant-group-design-in-tenant-manager) - [Access and permission issues](https://docs.turbo360.com/docs/access-and-permission-issues-in-tenant-manager)