To request a multi-tenancy account, contact [**enterprise@cerberusapp.com**](mailto:enterprise@cerberusapp.com).
## Core concepts - **Main multi-tenancy account**: the primary manager account that can access the global multi-tenancy workspace. - **Sub-account**: a delegated manager account created by the main account, with selectable enterprise assignments. - **Selected enterprise context**: the active enterprise currently open in the dashboard for day-to-day operations. - **Delegation**: permission granted by an enterprise owner that allows a manager account to enter and manage that enterprise. ## Navigation model When no enterprise context is selected, the side navigation shows multi-tenancy areas such as **Enterprises** and, for main accounts, **Sub-accounts**. After entering an enterprise, the dashboard switches to the standard single-enterprise navigation (Home, Users, Devices, Enrollment, Policies, and more). ## Ownership and delegation Each managed enterprise has an owner. The owner can always access that enterprise. Non-owner manager accounts can access an enterprise only when delegation is granted. - When an enterprise has its own administrator user, that administrator is the owner and decides which manager accounts can access the enterprise. - When an enterprise has no administrator user of its own, the main multi-tenancy account is the owner. - On enterprises owned by a customer administrator, the main account can grant or revoke access for its own sub-accounts while its own access is granted, but it can't grant access to itself. - If the enterprise administrator revokes access for the main account, access for its sub-accounts is revoked as well. - Removing an enterprise from a sub-account's assignments also removes that sub-account's access to the enterprise. If you assign it again later, access must be granted again. Enterprise administrators manage access from the **Enterprise manager access** card on the **Settings** page.Owner and delegation state are shown directly on enterprise cards to make access scope explicit before entering an enterprise.
## License and billing actions Multi-tenancy views expose license status, device limits, and enterprise billing actions. Depending on enterprise subscription state and your permissions, the card can show **Manage billing** or **Buy license**. For enterprises created by a multi-tenancy account, licensing is managed by multi-tenancy users. The main account can always manage licensing, while sub-accounts can manage licensing only when the main account enables **Can manage license** for that sub-account. ## Pages in this chapter - [**Managed enterprises**](https://enterprise.cerberusapp.com/docs/books/user-manual/page/managed-enterprises "Managed enterprises"): search, filters, card details, and enterprise creation. - [**Enterprise switching**](https://enterprise.cerberusapp.com/docs/books/user-manual/page/enterprise-switching "Enterprise switching"): top switcher behavior and scope transitions. - [**Sub-accounts**](https://enterprise.cerberusapp.com/docs/books/user-manual/page/sub-accounts "Sub-accounts"): delegated operators, assignments, and credentials management. # Managed enterprises The **Enterprises** page (*Dashboard* → *Enterprises*) is the control center for managed enterprise access. It lists all enterprises visible to your multi-tenancy account and lets you filter, inspect ownership/delegation, enter an enterprise context, and create new managed enterprises (main accounts only). ## Search and filters - **Search enterprise**: filters by enterprise name or enterprise ID. - **Delegation**: **All**, **Delegated**, or **Not delegated**. - **License status**: **All**, **Valid**, **Expiring**, **Expired**, or **Terminated**. ## Enterprise cards Each enterprise card shows key management metadata: - **License status** with icon badge and contextual tooltip. - **Licensed devices** (enterprise device limit). - **Next scheduled renewal** or **Expiration date**, depending on subscription state. - **Delegation** state (**Owner**, **Granted**, or **Not granted**). - **Owner** display name and username. ### Recently selected enterprises Enterprises that you accessed recently are pinned to a **Recently selected** section to speed up repeated context switching. ## Enterprise actions - **Enter enterprise**: opens the selected enterprise context when delegation/ownership allows access. - **Manage billing**: opens enterprise billing management when available and permitted. - **Buy license**: opens enterprise purchase flow when billing is not active. ### Who can manage licenses For enterprises created by a multi-tenancy account, license management is controlled by multi-tenancy users. The main account can always manage billing and license actions for those enterprises. Sub-accounts can manage billing and license actions only if the main account grants the **Can manage license** permission in the [**Sub-accounts**](https://enterprise.cerberusapp.com/docs/books/user-manual/page/sub-accounts "Sub-accounts") page. ## Create managed enterprise Main multi-tenancy accounts can expand **Create managed enterprise** from the bottom action area. - **Enterprise name** is required. - **Create per-enterprise admin user** controls ownership mode. - When enabled, **Admin username** (email format) and **Admin name** are required. - Before creation, a confirmation dialog summarizes the operation and, when applicable, warns that temporary credentials are sent by email to the new admin user.The new admin user must choose a new password the first time they sign in with the temporary password.
### Ownership mode - **Per-enterprise admin enabled**: the new admin user owns the enterprise and can delegate management to your multi-tenancy account. - **Per-enterprise admin disabled**: the enterprise is owned directly by your multi-tenancy account. ### Enterprise quota If the account reaches the configured enterprise quota, creation is blocked and the form shows a support contact message with current and maximum enterprise count.When the enterprise quota is reached, you cannot create additional managed enterprises until your limit is increased.
# Enterprise switching The enterprise switcher in the top toolbar lets multi-tenancy users move between delegated enterprises without logging out. It is available when at least one enterprise context can be selected. ## Switcher behavior - The trigger shows the current enterprise name (or enterprise ID if no name is available). - The menu lists delegated/accessible enterprises and marks the current enterprise as already selected. - During switching, switcher actions are temporarily disabled to prevent concurrent scope changes. ## Exit enterprise The switcher menu includes **Exit enterprise**, which clears the current enterprise context and returns you to the global multi-tenancy workspace. ## Context reset rules Switching enterprise or exiting enterprise resets the dashboard scope. Enterprise-specific pages and data refresh for the newly selected context, and menu visibility adapts to whether an enterprise is currently selected. The selected enterprise applies to all your open browser tabs. If you switch or exit an enterprise in one tab, the other tabs reload the dashboard on their next action, so they never operate on a different enterprise than the one shown.Use the switcher for fast operational context changes, but verify the selected enterprise name before running sensitive actions such as policy updates or device commands.
# Sub-accounts The **Sub-accounts** page (*Dashboard* → *Sub-accounts*) is available to main multi-tenancy accounts. It lets you create delegated manager users, assign managed enterprises, control billing permissions, and maintain sub-account credentials. ## Sub-account list Each sub-account card shows identity and management controls: - **Name** and **username/email**. - **Managed enterprises** multi-select assignment. - **Can manage license** permission toggle. - **Reset password** and **Delete** actions. ## Managed enterprises assignment Enterprise assignments are edited through the **Managed enterprises** multi-select field. When you close the selector after changes, the dashboard asks for confirmation before saving updates. Assigning an enterprise makes it available to the sub-account, but the sub-account can enter it only after access is granted. Removing an enterprise from the assignments also removes the sub-account's access to it. ## License management permission The **Can manage license** toggle controls whether a sub-account can access enterprise billing/license management actions. For enterprises created by the multi-tenancy account, the main account always has license management rights. Sub-accounts receive license management rights only when this toggle is enabled by the main account. ## Password reset **Reset password** generates a new temporary password and sends it to the sub-account by email after confirmation.When signing in with a temporary password, either after a reset or for a newly created sub-account, the user must choose a new password before continuing.
## Delete sub-account Deleting a sub-account requires confirmation and permanently removes delegated access for that account. ## Create sub-account Use the bottom action panel **Create sub-account** to add a new delegated manager. - **Email**: required and validated as email format. - **Name**: required display name. - **Can manage license**: optional initial billing permission. - Before creation, a confirmation dialog warns that a temporary password email is sent to the provided address.