Multi-Tenancy Options

This article explains how to set up several organizations on one Nanitor instance, for example one organization per customer if you are a managed service provider (MSP or MSSP).

Before you start

You need the System administrator role to create and manage organizations. If no one in your company has this role, contact Nanitor support.

Choose a structure

You can separate assets in three ways: with labels inside one organization, with separate organizations on one instance, or with separate Nanitor instances. The rule of thumb is one organization per company, and labels inside the company. For how each option works and how to choose, see Choosing a structure in the User Guide.

A customer can also be a top-level organization, but then nothing is inherited from your organization.

Create an organization

1. Click the gear icon in the upper right-hand corner and select System management.

   

2. Click Organizations in the left menu, and then click Add new organization. The Parent column shows which organizations are suborganizations.

   

3. Fill in the Create Organization dialog:

   • Server installation ID: read-only. You do not need to change it.
   • Name: the name of the organization, for example the customer's company name.
   • Customer Reference ID (optional): for MSPs, your internal billing or customer ID for this customer. It is hidden if left empty.
   • Parent: the organization this one belongs to, or (top-level). For a customer, choose your own organization. See Choose a parent below.
   • URL: the short name used in the organization's web address. It is shown as Slug in the Organizations list.

   

4. Click Create. Nanitor switches to the new organization and opens its dashboard.

Choose a parent

A suborganization is an organization with a parent. It gets inherited roles, inheritable labels and some locked settings from its parent, so your own staff and labels only need to be set up once. See What a suborganization inherits in the User Guide.

Only two levels are possible. The parent must be a top-level organization, and a suborganization cannot have suborganizations of its own.

Install agents into the right organization

Each organization has its own signup URL, and the signup URL decides which organization an asset goes into. Install agents with the signup URL of the organization the asset belongs to. If an asset ends up in the wrong organization, move it with Transfer to organization on the asset page or in the asset list. You need permission to manage assets in both organizations.

Switch between organizations

Click the current organization name in the top bar, click Switch organization, and select the organization. Suborganizations are listed under their parent.

The dashboards, assets, issues and reports of a parent organization cover only the parent's own assets. To see all your organizations together, use the Global overview.

Give your staff access to all customers

Switch to your own organization (the parent) and add your staff there with Inherited to suborganizations selected. They then have the same role in every customer organization, including customers you add later. If you have just created a customer organization, Nanitor has switched you into it, so switch back first.

For someone who needs read-only access to all your customers, such as a data protection officer, use the Auditor role with Inherited to suborganizations. For the steps, see How do I create a new user in my organization?.

Give a customer's staff access to their organization only

1. Switch to the customer's organization.

2. Add the user there, without Inherited to suborganizations, as described in How do I create a new user in my organization?. The user then cannot see your other customers.

   To limit the user to some of the customer's assets, for example one site, set Labels in the same dialog. The customer's organization needs a label for that site first, usually assigned by a labeling rule (for example by subnet). See Limit the user to some assets.

Change the parent later

A system administrator can change or remove an organization's parent afterwards. Go to System management → Organizations, open the organization's action menu (...) and select Edit, then choose a new Parent.

Some limits apply:

• The new parent must be a top-level organization.
• An organization that has suborganizations of its own cannot be given a parent. The Parent field is then disabled.
• The parent cannot be changed while the organization's own configuration uses a label inherited from the current parent, for example in a labeling rule, issue exception, alert rule, archival rule, user label scope, project or scheduled report. The error message lists what uses the labels. Change those items to use other labels first. Labels assigned to assets do not block the change.

When the parent changes, the organization takes the new parent's vulnerability checking and automatic agent upgrade settings, and the labels inherited from the old parent are removed. AI features follow the new parent. Use parent baseline is not turned on automatically when a parent is added later, so check it in the organization's settings.

Archive an organization

Archiving an organization also archives all of its suborganizations, and you cannot archive the organization you are currently in. Recover a parent organization before its suborganizations. See Archiving organizations.