Skip to main content

Multi-tenancy overview

The Multi-tenancy section is available to MSP and enterprise manager accounts that manage multiple customer enterprises from a single login. This chapter explains the enterprise scope model, enterprise switching, managed enterprise administration, and sub-accounts.

To request a multi-tenancy account, contact enterprise@cerberusapp.com.

Core concepts

  • Main multi-tenancy account: the primary manager account that can access the global multi-tenancy workspace.
  • Sub-account: a delegated manager account created by the main account, with selectable enterprise assignments.
  • Selected enterprise context: the active enterprise currently open in the dashboard for day-to-day operations.
  • Delegation: permission granted by an enterprise owner that allows a manager account to enter and manage that enterprise.

Navigation model

When no enterprise context is selected, the side navigation shows multi-tenancy areas such as Enterprises and, for main accounts, Sub-accounts. After entering an enterprise, the dashboard switches to the standard single-enterprise navigation (Home, Users, Devices, Enrollment, Policies, and more).

Ownership and delegation

Each managed enterprise has an owner. The owner can always access that enterprise. Non-owner manager accounts can access an enterprise only when delegation is granted.

  • When an enterprise has its own administrator user, that administrator is the owner and decides which manager accounts can access the enterprise.
  • When an enterprise has no administrator user of its own, the main multi-tenancy account is the owner.
  • On enterprises owned by a customer administrator, the main account can grant or revoke access for its own sub-accounts while its own access is granted, but it can't grant access to itself.
  • If the enterprise administrator revokes access for the main account, access for its sub-accounts is revoked as well.
  • Removing an enterprise from a sub-account's assignments also removes that sub-account's access to the enterprise. If you assign it again later, access must be granted again.

Enterprise administrators manage access from the Enterprise manager access card on the Settings page.

Owner and delegation state are shown directly on enterprise cards to make access scope explicit before entering an enterprise.

License and billing actions

Multi-tenancy views expose license status, device limits, and enterprise billing actions. Depending on enterprise subscription state and your permissions, the card can show Manage billing or Buy license.

For enterprises created by a multi-tenancy account, licensing is managed by multi-tenancy users. The main account can always manage licensing, while sub-accounts can manage licensing only when the main account enables Can manage license for that sub-account.

Pages in this chapter