# Tenants

A tenant in HPE Morpheus Enterprise is an isolated environment with its own unique users, workloads, and groups. Multi-tenancy organizes tenants into a hierarchy of primary tenant, parent tenants, and sub tenants within a single platform.

A tenant is an isolated environment within HPE Morpheus Enterprise, with its own unique users, workloads, and Groups. Tenants enable organizations and large enterprises to delegate administration, enforce policies, and track costs across multiple business units or customers from a single platform.

The HPE Morpheus Enterprise multi-tenancy ([Figure: Multi-tenancy](https://support.hpe.com/hpesc/public/api/document/sd00008375en_us/render?page=GUID-C9B54784-02A9-4194-AFA3-F99B9E08F50B.html#GUID-C9B54784-02A9-4194-AFA3-F99B9E08F50B__FIG_CVL_MBN_BKC)) is built around three tenant types that is primary tenant parent tenant, and subtenant. Each tenant operates as a fully isolated environment, with resources, users, and workloads kept separate from peer tenants. Access to resources across tenant boundaries is controlled through visibility settings and explicit assignments from higher-level tenants. The following concepts provide the foundation for understanding the multi-tenancy model in HPE Morpheus Enterprise.

- **Primary tenant** – The tenant created by default during the initial installation of an HPE Morpheus Enterprise appliance. Only one primary tenant can exist per appliance. As a primary tenant user, you configure global policies, integrate infrastructure, and manage identity federation. You can scope and assign resources to all tenants across the hierarchy, and must create Multi-Tenant User Roles before subtenant users can be added.
- **Parent tenant** – Any tenant that has child tenants created beneath it. Both the primary tenant and subtenants can act as parent tenants. As a parent tenant user, you define tenant roles that set the maximum permission boundaries for all users within your child tenants. After defining the tenant roles, you can assign resources only to your immediate child tenants.
- **Subtenant** – A tenant created under a parent tenant. Subtenants provide isolated, self-service environments for individual business units or customers. As a subtenant user, you can create user roles within the permission boundaries configured by your parent tenant user, but cannot exceed those boundaries. You cannot view or access resources belonging to other subtenants. Instead, you can only access parent tenant resources that are explicitly assigned or made public.
- **Tenant users** – Users are specific to the tenant in which they are created and can only access that tenant. Each tenant maintains its own list of users, displaying their name, username, email, and assigned role. You can create, edit, and delete users from within your tenant. The primary tenant user must create a multi-tenant user role before adding subtenant users.
- **Tenant user roles** –

  Tenant user roles define the maximum permission levels available to users within a tenant. As a parent tenant user, you configure tenant user roles to govern how permissions flow through the hierarchy. User role permissions within a tenant cannot exceed the permissions set by the assigned tenant user role. Note the following:

  - A tenant user role sets the maximum permissions for a tenant and can be assigned to one or more tenants.
  - User roles within a tenant cannot exceed the permissions of the assigned tenant user role. However, you can create user roles within a subtenant with lesser permissions than the tenant user role allows.
  - You configure cloud access within the tenant user role. All clouds in the parent tenant with visibility set to Public appear as options on the tenant user role Cloud Access tab. Only clouds explicitly granted accesses in the tenant user role are accessible within the subtenant.

  IMPORTANT

  Tenant user roles cap permissions on all subtenant user roles. As a parent tenant user, you set the maximum permissions for the subtenant via the tenant user role. As a subtenant user, you can then configure user roles within those boundaries.

  In a multi-tenant environment, tenant user roles are classified as either single-tenant or multi-tenant:

  - **Single-tenant user roles** – Exist solely within the tenant in which they are created and cannot be shared across tenants.
  - **Multi-tenant user roles** – Created by a parent tenant user and automatically seeded into child tenants. These roles can be assigned to users within each child tenant. Any changes made to a multi-tenant user role in the parent tenant are propagated to all child tenants. However, if a multi-tenant user role is edited within a child tenant, it is no longer linked to the parent definition and becomes a unique single-tenant role. It no longer receives propagated changes from the parent tenant.

    NOTE

    Multi-tenant user roles simplify subtenant user role creation by eliminating the need for you, as a parent tenant user, to re-create the same base roles for every subtenant. A multi-tenant user role is not a single shared role across tenants and it functions as a template that generates individual subtenant user roles. These subtenant user roles can then be independently managed within each subtenant.
- **Isolation** – Each tenant is a fully isolated environment. As a subtenant user, you cannot view resources belonging to other subtenants or to other parent tenants. You can access primary tenant resources only if a primary tenant user has set those resources to public visibility or explicitly assigned them to your tenant.

 

Figure 1. Multi-tenancy

![HPE Morpheus Enterprise multi-tenancy](https://support.hpe.com/hpesc/public/api/document/sd00008375en_us/GUID-EFC585B4-B817-4562-98C6-62EA5184DB87-high.png) 

Figure 2. **Example: CSP with reseller channel**![CSP with reseller channel](https://support.hpe.com/hpesc/public/api/document/sd00008375en_us/GUID-1CC0D09E-B3C6-4B37-B4DA-F32AEA2938D0-high.png)

[Figure: Example: CSP with reseller channel CSP with reseller channel](https://support.hpe.com/hpesc/public/api/document/sd00008375en_us/render?page=GUID-C9B54784-02A9-4194-AFA3-F99B9E08F50B.html#GUID-C9B54784-02A9-4194-AFA3-F99B9E08F50B__FIG_GC5_CDN_BKC)  demonstrates how a cloud service provider ("CSP Provider, Inc.") uses three-tier multi-tenancy to serve both direct customers and a reseller partner. In this structure, each parent tenant independently manages its own subtenants and enforces guardrails for resource provisioning, including VM vending, instance and app blueprints, and infrastructure-as-code workflows.

- **CSP Provider, Inc.** (primary tenant) – The top-level tenant is responsible for global governance, identity federation, and infrastructure integration. It sets platform-wide policies, manages identity providers, and controls access to shared infrastructure resources across all parent tenants and subtenants.
- **CSP (Direct Customers)** (parent tenant) – Manages the cloud service provider's own direct customer accounts, with subtenants **Coke** and **Pepsi**, and supports extra subtenants. Pepsi operates its own provisioned clouds (**Cloud A**, **Cloud B**, and **Cloud C**).
- **Reseller: UP 7x24** (parent tenant) – A third-party reseller partner with delegated administration and quota enforcement, with subtenants Acme Coyote and Acme Runner, and supports extra subtenants.

**Subtopics**  

- **[Key concepts](https://support.hpe.com/hpesc/public/api/document/sd00008375en_us/render?page=GUID-AD3C26B8-A41C-4875-B9C9-1A350E1CF2CD.html)**  
   Key concepts describe the tenant types and isolation principles that governs the HPE Morpheus Enterprise multi-tenancy model.
- **[Roles](https://support.hpe.com/hpesc/public/api/document/sd00008375en_us/render?page=GUID-49067498-304A-4C38-B9C1-D8CF296DD3FA.html)**
- **[Tenants](https://support.hpe.com/hpesc/public/api/document/sd00008375en_us/render?page=GUID-701A5EFA-E128-49D6-B12E-0C2415D4F83A.html)**
- **[Tenant Users](https://support.hpe.com/hpesc/public/api/document/sd00008375en_us/render?page=GUID-8C608C16-055C-4708-BA01-87FACE15EF6D.html)**
- **[Configuring Tenants and Resources for Multi-Tenancy](https://support.hpe.com/hpesc/public/api/document/sd00008375en_us/render?page=GUID-81B4F7F1-22DE-4285-BD37-B5C4D03E0063.html)**  
   Configure tenants and tenant users in HPE Morpheus Enterprise to control access, permissions, and resource visibility across the multi-tenancy hierarchy.
