Multi-tenancy
Multi-tenancy overview
The Multi-tenancy section is available to MSP and enterprise manager accounts that manage multiple customer enterprises from a single login. This chapter explains the enterprise scope model, enterprise switching, managed enterprise administration, and sub-accounts.
To request a multi-tenancy account, contact enterprise@cerberusapp.com.
Core concepts
- Main multi-tenancy account: the primary manager account that can access the global multi-tenancy workspace.
- Sub-account: a delegated manager account created by the main account, with selectable enterprise assignments.
- Selected enterprise context: the active enterprise currently open in the dashboard for day-to-day operations.
- Delegation: permission granted by an enterprise owner that allows a manager account to enter and manage that enterprise.
Navigation model
When no enterprise context is selected, the side navigation shows multi-tenancy areas such as Enterprises and, for main accounts, Sub-accounts. After entering an enterprise, the dashboard switches to the standard single-enterprise navigation (Home, Users, Devices, Enrollment, Policies, and more).
Ownership and delegation
Each managed enterprise has an owner. The owner can always access that enterprise. Non-owner manager accounts can access an enterprise only when delegation is granted.
Owner and delegation state are shown directly on enterprise cards to make access scope explicit before entering an enterprise.
License and billing actions
Multi-tenancy views expose license status, device limits, and enterprise billing actions. Depending on enterprise subscription state and your permissions, the card can show Manage billing or Buy license.
For enterprises created by a multi-tenancy account, licensing is managed by multi-tenancy users. The main account can always manage licensing, while sub-accounts can manage licensing only when the main account enables Can manage license for that sub-account.
Pages in this chapter
- Managed enterprises: search, filters, card details, and enterprise creation.
- Enterprise switching: top switcher behavior and scope transitions.
- Sub-accounts: delegated operators, assignments, and credentials management.
Managed enterprises
The Enterprises page (Dashboard → Enterprises) is the control center for managed enterprise access. It lists all enterprises visible to your multi-tenancy account and lets you filter, inspect ownership/delegation, enter an enterprise context, and create new managed enterprises (main accounts only).
Search and filters
- Search enterprise: filters by enterprise name or enterprise ID.
- Delegation: All, Delegated, or Not delegated.
- License status: All, Valid, Expiring, Expired, or Terminated.
Enterprise cards
Each enterprise card shows key management metadata:
- License status with icon badge and contextual tooltip.
- Licensed devices (enterprise device limit).
- Next scheduled renewal or Expiration date, depending on subscription state.
- Delegation state (Owner, Granted, or Not granted).
- Owner display name and username.
Recently selected enterprises
Enterprises that you accessed recently are pinned to a Recently selected section to speed up repeated context switching.
Enterprise actions
- Enter enterprise: opens the selected enterprise context when delegation/ownership allows access.
- Manage billing: opens enterprise billing management when available and permitted.
- Buy license: opens enterprise purchase flow when billing is not active.
Who can manage licenses
For enterprises created by a multi-tenancy account, license management is controlled by multi-tenancy users. The main account can always manage billing and license actions for those enterprises.
Sub-accounts can manage billing and license actions only if the main account grants the Can manage license permission in the Sub-accounts page.
Create managed enterprise
Main multi-tenancy accounts can expand Create managed enterprise from the bottom action area.
- Enterprise name is required.
- Create per-enterprise admin user controls ownership mode.
- When enabled, Admin username (email format) and Admin name are required.
- Before creation, a confirmation dialog summarizes the operation and, when applicable, warns that temporary credentials are sent by email to the new admin user.
Ownership mode
- Per-enterprise admin enabled: the new admin user owns the enterprise and can delegate management to your multi-tenancy account.
- Per-enterprise admin disabled: the enterprise is owned directly by your multi-tenancy account.
Enterprise quota
If the account reaches the configured enterprise quota, creation is blocked and the form shows a support contact message with current and maximum enterprise count.
When the enterprise quota is reached, you cannot create additional managed enterprises until your limit is increased.
Enterprise switching
The enterprise switcher in the top toolbar lets multi-tenancy users move between delegated enterprises without logging out. It is available when at least one enterprise context can be selected.
Switcher behavior
- The trigger shows the current enterprise name (or enterprise ID if no name is available).
- The menu lists delegated/accessible enterprises and marks the current enterprise as already selected.
- During switching, switcher actions are temporarily disabled to prevent concurrent scope changes.
Exit enterprise
Context reset rules
Switching enterprise or exiting enterprise resets the dashboard scope. Enterprise-specific pages and data refresh for the newly selected context, and menu visibility adapts to whether an enterprise is currently selected.
Use the switcher for fast operational context changes, but verify the selected enterprise name before running sensitive actions such as policy updates or device commands.
Sub-accounts
The Sub-accounts page (Dashboard → Sub-accounts) is available to main multi-tenancy accounts. It lets you create delegated manager users, assign managed enterprises, control billing permissions, and maintain sub-account credentials.
Sub-account list
Each sub-account card shows identity and management controls:
- Name and username/email.
- Managed enterprises multi-select assignment.
- Can manage license permission toggle.
- Reset password and Delete actions.
Managed enterprises assignment
Enterprise assignments are edited through the Managed enterprises multi-select field. When you close the selector after changes, the dashboard asks for confirmation before saving updates.
License management permission
The Can manage license toggle controls whether a sub-account can access enterprise billing/license management actions.
For enterprises created by the multi-tenancy account, the main account always has license management rights. Sub-accounts receive license management rights only when this toggle is enabled by the main account.
Password reset
Reset password generates a new temporary password and sends it to the sub-account by email after confirmation.
Delete sub-account
Deleting a sub-account requires confirmation and permanently removes delegated access for that account.
Create sub-account
Use the bottom action panel Create sub-account to add a new delegated manager.
- Email: required and validated as email format.
- Name: required display name.
- Can manage license: optional initial billing permission.
- Before creation, a confirmation dialog warns that a temporary password email is sent to the provided address.