# Configuring Tenants and Resources for Multi-Tenancy

Configure tenants and tenant users in HPE Morpheus Enterprise to control access, permissions, and resource visibility across the multi-tenancy hierarchy.

Configuring tenants and resources for multi-tenancy allows administrators to establish isolated environments, control resource visibility, and manage access across the tenant hierarchy. To configure tenants and resources in HPE Morpheus Enterprise, the primary tenant serves as the top-level administrative authority enabling the administrators to perform the following:

- Create subtenants
- Assign roles
- Federate identity sources
- Define how resources are shared or restricted across the hierarchy.

This section includes procedures that allow you to create and manage tenants, manage tenant users, and control resource visibility and assignment across the multi-tenancy hierarchy.

## Tenants

Tenants are isolated environments in HPE Morpheus Enterprise, each with their own users, workloads, and groups, organized within a multi-tenancy hierarchy.

There are essentially two types of Tenants in HPE Morpheus Enterprise

- Primary tenant
- Subtenants

### Creating a Tenant

#### About this task

Tenants are created and managed from the Tenants page. When creating a tenant, you define its name, base role, parent tenant, and optional billing and identity settings that determine how the tenant operates within the hierarchy.

NOTE

The primary tenant is created during the initial appliance setup. The tenants you create using this procedure are parent tenants and subtenants.

To create a new parent tenant and a subtenant

#### Procedure

1. Navigate to Administration > Tenants.
2. Click +Create Tenant.
3. In the New Tenant dialog, complete the following:
   1. Name – Enter a unique name to identify the tenant.
   2. Description – (Optional) Enter a brief description of the tenant's purpose or ownership.
   3. **Enabled** – Verify that the checkbox is selected to activate the tenant and allow users to access the same.
   4. **Subdomain** – (Optional) Enter a subdomain to create a direct login URL for identity sources, or to use as a login prefix to identify the tenant (for example, `subdomain\username`).
   5. **Parent Tenant** – Select the parent tenant from the drop-down list. The new tenant is created as a subtenant of the selected parent.
   6. **Base Role** – Select the base role for the tenant. All roles created within the tenant inherits this role as the minimum permission baseline.
   7. **Currency** – Select the currency used for pricing, costing, and chargeback within the tenant.
4. (Optional) Expand **Advanced Options** and complete the following:
   1. **Account Number** – Enter an external account number associated with you cloud provider for reference or integration with billing systems.
   2. **Account Name** – Enter the account name associated with you cloud provider, typically used for reporting or charge-back purposes.
   3. **Customer Number** – Enter a customer number to associate the tenant with an external customer record.
5. Click Save Changes.

#### Results

New tenant is created and it should appear in the Tenants page.

NOTE

In prior versions, we could set limits when creating a subtenant. These could restrict the amount of storage, memory, and CPUs that can be collectively provisioned by all users in the Tenant. In more recent versions, this functionality has been rolled into Policies (Administration > Policies). When creating a Policy, we are able to specify a Tenant to which the Policy should apply.

### Viewing Tenants

View and manage all tenants configured from the Tenants page.

#### About this task

The Tenants page provides a centralized view of all tenants configured within HPE Morpheus Enterprise, displaying key details such as tenant name, assigned base role, parent tenant, number of instances and users, status, and creation date. Use the following procedure to view tenants in HPE Morpheus Enterprise.

#### Procedure

1. Navigate to Administration > Tenants.
2. Review the following details for each tenant in the list:

   - Name – The display name of the tenant. Tenants marked with an asterisk (\*) indicate the primary tenant.
   - Role – The base role assigned to the tenant, which defines the maximum permission level for all users within the tenant.
   - Parent Tenant – The parent tenant to which this tenant belongs. This field is empty for the primary tenant.
   - # Instances – The total number of instances currently provisioned within the tenant.
   - # Users – The total number of users associated with the tenant.
   - Status – The current state of the tenant. A status of **Active** indicates the tenant is enabled and accessible to its users.
   - Date Created – The date and time the tenant was created in HPE Morpheus Enterprise.

### Creating a Tenant User

Users in HPE Morpheus Enterprise are tenant-specific and can only access the tenant in which they are created.

#### About this task

Each tenant in HPE Morpheus Enterprise maintains its own set of users, isolated from other tenants in the hierarchy. Users created in the primary tenant or any subtenant can only access the tenant they belong to and cannot access resources or data in other tenants. Use the following procedure to create a user within a tenant:

#### Procedure

1. Navigate to Administration > Tenants.
2. In the Tenants list, click the tenant in which you want to create the user.
3. Click + Create User in the tenant summary page.
4. In the **New User** dialog, complete the following:
   1. **Username** – Enter a unique username for the user
   2. **First Name** – Enter the user's first name.
   3. **Last Name** – Enter the user's last name.
   4. **Email** – Enter the user's email address, used for notifications and password resets.
   5. **Receive Notifications** – (Optional) Select to enable email notifications for provisioning events and system alerts.
   6. In the **Roles** section, start entering the user role to search for and assign the appropriate role or roles to define the user's permissions within the tenant.
   7. In the **Credentials** section, complete the following:

      - **Password** – Enter a password that meets the platform's password policy requirements.
      - **Confirm Password** – Re-enter the password to confirm.
      - **Enabled** – Select the checkbox for activating the user account. Clear this option to deactivate the user account.
      - **Account Locked** – (Optional) Select to prevent the user from logging in without disabling the account entirely.
      - **Password Expired** – (Optional) Select to force the user to set a new password on first login.
   8. (Optional) In the **Linux Settings** section, complete the following to configure Linux-based provisioning access:

      - **Username** – Enter the Linux username used for SSH access to provisioned instances.
      - **Password** – Enter the Linux password for SSH authentication.
      - **Confirm Password** – Reenter the Linux password for confirmation.
      - **SSH Key** – Select an SSH key pair to enable key-based authentication for Linux instances.
   9. (Optional) In the **Windows Settings** section, complete the following to configure Windows-based provisioning access:

      - **Username** – Enter the Windows username used for remote access to provisioned instances.
      - **Password** – Enter the Windows password for remote access.
      - **Confirm Password** – Reenter the Windows password for confirmation.
      - **SSH Key** – Select an SSH key pair to enable key-based authentication for Linux instances.
5. Click Save Changes.

#### Results

Tenant user is created.

NOTE

Instance Resource Limits for a user are now configured through [Policies](https://support.hpe.com/hpesc/public/api/document/sd00008375en_us/render?page=GUID-3D3058F0-C2FE-4995-8D62-55A069D50709.html#GUID-B0152179-D5F5-49E3-9CDD-E6BD2573DC0F)

### Impersonating Tenant User

Impersonate a tenant user to access HPE Morpheus Enterprise as that user and troubleshoot or verify their experience.

#### About this task

HPE Morpheus Enterprise allows admin users in a parent tenant to impersonate any user in their child tenants, providing a view of the platform as that user sees it. To impersonate a user, you must be logged in as a user with the impersonate user feature enabled in the assigned role. Use the following procedure to impersonate a tenant user in HPE Morpheus Enterprise.

#### Procedure

1. Navigate to Administration > Tenants.
2. Click the name of the tenant containing the user you want to impersonate.
3. In the Users tab, locate the user you want to impersonate.
4. In the Actions drop-down list next to the user, select Impersonate.

#### Results

HPE Morpheus Enterprise logs you in as the selected user in their respective tenant.

NOTE

To stop impersonating, click the username in the header and select Quit Impersonating.

## Resources

Configure resource visibility and assignments in the primary tenant to control subtenant access to resources in HPE Morpheus Enterprise.

In the primary tenant, you can configure resources with either of the following visibility settings:

- Private – Restricts the resource to the assigned tenant only.
- Public – Makes the resource available across all tenants. This option is available in the primary tenant only.

You can also assign resources directly from the primary tenant to a subtenant. When you assign a resource to a subtenant, only that subtenant can access it, and its visibility is automatically set to private. Public visibility is not available for resources assigned to or created in a subtenant.

You can assign primary tenant resources to subtenants. When you do, the resource is no longer available for use by the primary tenant, but remains visible and editable from the primary tenant. Resources assigned to a subtenant are visible and available for use within that subtenant. However, the subtenant cannot edit or reassign them.

From the primary tenant, you can configure the following resources for public visibility across all tenants, or assign them to individual subtenants:

- Clouds
- Hosts
- Virtual machines
- Networks
- Datastores
- Resource pools
- Folders
- Virtual images
- Library instance types
- Plans and pricing
- Policies
- Workflows
- Roles

NOTE

You can make blueprints of virtual image available to multiple selected tenants when set to private.

### Updating Cloud Visibility

Set the visibility of a cloud to public (shared across all tenants) or private (available only to the assigned tenant) in HPE Morpheus Enterprise.

#### Prerequisites

You must meet all the prerequisites in .

#### About this task

Cloud visibility controls whether a cloud is available only to the primary tenant or shared across all tenants. Setting a cloud to public makes it available for subtenants to add, while setting it to private restricts it to the assigned tenant only. The resources accessible within a cloud to a subtenant depend on the visibility or assignment of the individual resources within that cloud.

#### Procedure

1. Navigate to Infrastructure > Clouds.
2. Click the edit icon at the end of the cloud row. Alternatively, you can click the cloud name and click Edit on the cloud details page.
3. In the Edit Cloud dialog, complete the following:.
   1. From the Visibility drop-down list, select one of the following:

      - Private – When selected, the resource is only available to the assigned tenant.
      - Public – When selected, the resource is available across all tenants. This option is available in the primary tenant only.

        NOTE

        All the subtenants created after this change automatically have the cloud added, and a group is created for each available cloud matching the cloud name in the new subtenant. For subtenants created before this change, the subtenant has the option to add the cloud but it is not added automatically. The resources accessible within the cloud to a subtenant depend on the visibility or assignment of individual resources.
   2. Click Save Changes.

#### Results

When you assign a cloud to a subtenant, it is removed from the primary tenant's available clouds. The primary tenant still maintains control and visibility, and you can edit the cloud settings or reassign the cloud at any time.

### Assign a Cloud to an Tenant

IMPORTANT

When assigning a Cloud to a Tenant, all resources for that Cloud will only be available to the assigned Tenant. If a cloud is created in the Master Tenant and assigned to a sub-Tenant, it will no longer be available for use by the Master Tenant or any other sub-Tenants, although it can be assigned back to the Master Tenant, or to another sub-Tenant.

It may be preferable for service providers to share or assign their cloud resources, such as specific hosts, networks, resources pools and datastores, across sub-Tenants, rather than an entire cloud.

### Assigning Cloud to a Subtenant

Assign a cloud from the primary tenant to a subtenant in HPE Morpheus Enterprise.

#### Prerequisites

You must meet all the prerequisites in .

#### About this task

When a cloud is assigned to a subtenant, or assigned to the primary tenant with private visibility, that cloud and all of its resources are only available to the assigned tenant. The cloud is no longer available for use by the primary tenant or any other subtenants. However, the primary tenant still maintains control and visibility, and can edit the cloud settings or re-assign the cloud. Alternatively, you can share or assign individual cloud resources such as specific hosts, networks, resource pools, and datastores across subtenants, rather than assigning an entire cloud.

#### Procedure

1. Navigate to Infrastructure > Clouds .
2. Click the edit icon at the end of the cloud row. Alternatively, you can click the cloud name and click Edit on the cloud details page.
3. In the Edit Cloud dialog, complete the following:
   1. From the Tenant drop-down list, select the tenant to assign the cloud to. When you assign a cloud to a subtenant, The visibility is automatically set to Private.
   2. Click Save Changes.

### Individual Resource Visibility & Assignment

Similar to clouds, individual resources from the Master Tenant can be set to public and available to sub-Tenants, or assigned to sub-Tenants.

By default, any host, virtual machine, bare metal server, network, resource pool, datastore or blueprint added, created or inventoried by an Tenant is assigned to that Tenant. If these resources are in the Master Tenant, they can be assigned to sub Tenants. Assigning one of these resources will make it unavailable to the Master Tenant, but it will still be visible and editable by the Master Tenant. This allows Master Tenant resources to be isolated for use by sub-Tenants while still under the control of the Master Tenant.

Resources assigned to sub-Tenants from the Master Tenant will be visible and available for use by that sub-Tenant, however they cannot be edited or re-assigned by the sub-tenant.

### Set the Visibility of a Host, Virtual Machine or Bare metal Server to Public or Private

#### Procedure

1. From the Master Tenant, navigate to Infrastructure, Hosts
2. Select either the Hosts, Virtual Machines or Bare Metal tab
3. Click the name of the resource
4. Select Edit in the resource page to bring up the config modal
5. From the “Visibility” drop down, select either “Public” or “Private”
6. Select Save Changes

#### Results

![../../_images/configuring_multi_tenancy-d738d.png](https://support.hpe.com/hpesc/public/api/document/sd00008375en_us/GUID-A6C1B836-5DF2-47CE-A78A-0A94A1A777C0-high.png)

Assigning a Host, Virtual Machine, or Bare Metal server to an Tenant

1. From the Master Tenant, navigate to Infrastructure, Hosts
2. Select either the Hosts, Virtual Machines or Bare Metal tab
3. Click the name of the resource
4. From the “Actions” dropdown in the the resource page, select Assign Tenant
5. In the Assign Tenant modal, select the Tenant to assign the resource to.
6. Select Execute in the modal

![../../_images/configuring_multi_tenancy-3c39f.png](https://support.hpe.com/hpesc/public/api/document/sd00008375en_us/GUID-0DC2CDEE-E498-4EF1-B0B5-B54260A82FF7-high.png)

The resource will now be assigned and available for use by the assigned Tenant. If assigned to a sub-Tenant, the Master Tenant will maintain visibility and control.

### Set the Visibility of a Network to Public or Private

#### Procedure

1. From the Master Tenant, navigate to Infrastructure, Network
2. Select either the pencil/edit icon in the network row, or click the name of the network and select “Edit” in the network page.
3. From the “Visibility” drop down, select either “Public” or “Private”
4. Select Save Changes in the modal

#### Results

![../../_images/configuring_multi_tenancy-bc333.png](https://support.hpe.com/hpesc/public/api/document/sd00008375en_us/GUID-9AB26FDA-4C5C-4F4C-ACD5-1013B6D3F162-high.png)

### Assign a Network to an Tenant

#### Procedure

1. From the Master Tenant, navigate to Infrastructure, Network
2. Select either the pencil/edit icon in the network row, or click the name of the network and select “Edit” in the network page.
3. From the “Tenant” drop down, select an Tenant to assign the network to.
4. Select Save Changes in the lower the modal

#### Results

![../../_images/configuring_multi_tenancy-9f15c.png](https://support.hpe.com/hpesc/public/api/document/sd00008375en_us/GUID-FC41C95A-2672-476A-B22E-2C2541407BB8-high.png)

The Network will now be assigned and available for use by the assigned Tenant. If assigned to a sub-Tenant, the Master Tenant will maintain visibility and control.

Set the Visibility or assign a datastore to an Tenant

1. From the Master Tenant, navigate to Infrastructure, Storage
2. Select the “Data Stores” tab
3. Select Edit from the “Actions” dropdown in the datastores row
4. From the “Visibility” drop down, select either “Public” or “Private”
5. From the “Tenant” drop down, select the Tenant to assign the datastore to.

   NOTE

   If assigned to a sub-tenant, the visibility will be automatically set to private.
6. Select Save Changes in the modal

![../../_images/configuring_multi_tenancy-1e978.png](https://support.hpe.com/hpesc/public/api/document/sd00008375en_us/GUID-77B5C886-86F4-40C1-A0D1-DE6EDDA1EBBB-high.png)

### Set the Visibility or assign a Virtual Image to an Tenant

#### Procedure

1. From the Master Tenant, navigate to Provisioning, Virtual Images
2. Select Edit from the “Actions” dropdown in the Virtual Images row
3. From the “Visibility” drop down, select either “Public” or “Private”. Public will share the
4. From the “Tenant” field, start typing the name of the Tenant to assign the Virtual Image to. Matching Tenants will populate, then select the Tenant to add. 

   NOTE

   Virtual Images can be set to Private, but accessible to more that one Tenant

#### Results

#. Repeat step 4 for all Tenants requiring access to the virtual image. .. To remove access for an Tenant, click the “x” next to the Tenant name #. Select Save Changes in the modal

![../../_images/configuring_multi_tenancy-d9abe.png](https://support.hpe.com/hpesc/public/api/document/sd00008375en_us/GUID-453CA12C-D7A9-4CFE-83D3-B133334EE8C4-high.png)

The Virtual Image will now be available for use by the assigned Tenants.
