Previous Topic: Custom GroupsNext Topic: Permission Groups and Context Groups

Creating and Managing Groups › Types of Groups › Groups for Multi-Tenant Deployments

Groups for Multi-Tenant Deployments

When the global administrator (the administrator for the Default Tenant) creates at least one tenant, features to support multi-tenancy are enabled. "Multi-tenant deployments" consist of multiple discrete enterprises with potentially overlapping IP addresses. Additional groups appear in the Groups tree to let the administrator organize tenant inventories and allocate permissions:

Defined Tenants The Tenants system group contains all tenants defined in the system.

Includes all tenants. Tenants are used with IP domains to monitor separate customer environments with a single CA Performance Center instance. Each tenant can contain multiple subgroups of items that are not shared among tenants.

Tenant administrators can create custom groups within their tenant. For the global administrator, tenant groups appear under the Tenant node in the Groups tree.

Service Provider Global Groups Custom groups are used to organize managed items and filter data

Contains groups of items that help the global administrator manage tenant environments. These groups let the administrator visualize and organize shared items–any items not explicitly associated with a tenant IP domain.

The groups that actually allocate access to data from shared items appear under each tenant. See "Service Provider Defined Groups."

When you expand the top-level Inventory group, the following additional group appears in a multi-tenant deployment:

Domains The IP Domains group contains IP domains defined in the system.

Includes all of the custom IP domains that are used to associate managed items with tenants. Also includes the Default Domain, which contains all items not explicitly assigned to a custom domain. For more information, see IP Domains.

In a multi-tenant deployment, each tenant has its own groups. Tenant users cannot see items outside of the tenant group unless the global administrator grants such access with Service Provider groups.

Groups (Tenant) Custom groups are used to organize managed items and filter data

Lets the global administrator or tenant administrator create custom groups. Select this node to enable the Add Group button.

Inventory (Tenant) System groups are read-only as indicated by the lock symbol.

Includes all managed items that are associated with the tenant IP domains. Items from all registered data sources can appear in this group.

Each tenant also has the following system subgroups in its Inventory group:

IP Domains

Represents the IP domains that are associated with this tenant. Any managed items that have been discovered are associated with this tenant through its IP domains. Click a tenant IP domain in the Groups tree to see the tenant's managed items.

Service Provider Defined Groups System groups are read-only as indicated by the lock symbol.

Includes groups that the global administrator has populated with shared items whose data this tenant should be able to access. Use these groups to grant access to data from shared devices to selected tenant user accounts.

For example, a router that the service provider owns handles traffic from multiple tenant domains. Using Service Provider Defined groups, the global administrator can allocate tenant access to data from that router. This strategy lets the tenant perform some independent monitoring and verification of system performance.

Service Provider Items System Groups are automatically created when items are discovered

Contains all items not explicitly associated with a tenant IP domain. Such items are automatically placed in this group. The global administrator can then place these items into 'Service Provider Defined Groups' to allocate tenant access to data from shared items.