ControlUp for Multi-Tenancy Environments

ControlUp Real-Time DX supports multi-tenancy environments where tenants manage their own infrastructure within their own domains. This isolation between the MSP and tenants ensures that tenants can maintain control over their own data and applications without concerns about interference or unauthorized access from other tenants.

In this article, we explain the general concept of a single-tenant deployment type. In this setup, all tenants connect to the same ControlUp organization, and segregation of ControlUp Monitors and data sources is ensured by Sites.

Prerequisites

• ControlUp version 8.8 or later.
• A general prerequisite for the monitor cluster is that monitors in the Default Site (Management Network) need to be able to resolve the FQDN of all tenant monitors and must have bidirectional connectivity over TCP port 40706. See the Architecture Overview below for more information.

Overview

• There is a network separation between tenant domains a.local and b.local, meaning they do not have visibility or connectivity to each other.
• The only component that leaves the tenant network and connects to the management network is the ControlUp Monitors. (see below).
• Outbound Internet connectivity from the console and monitors still apply in multi-tenancy mode.
• Each tenant is organized as a Site. This means that the MSP needs to create a Site for each tenant.
• The service provider must ensure that the Security Policy is configured accordingly. Tenant permissions for viewing data are managed via the View Folder permission in the Security Policy. We recommend configuring each tenant under a separate folder in the organizational tree.
• If you configure the Security Policy accordingly (see Step 6), VDI & DaaS in DEX will only display tenant data relevant to each specific tenant.

Architecture Overview

Required Inbound / Outbound Rules

How to Set Up a Multi-Tenancy Environment

Step 1: Configure Advanced Authentication

1. Open the Real-Time DX Console in the management network.
2. Right-click the ControlUp organization > Properties > Advanced Authentication.
3. Ensure that the organization uses Advanced Authentication if the Enable Advanced Authentication checkbox is grayed out. If the box is unchecked, you need to set up Advanced Authentication.
   

For version 8.8 only: Configure MSP Mode

4. Remove Monitors: After enabling Advanced Authentication, remove all monitors in your ControlUp environment. This step is essential because switching to multi-tenancy mode is not possible with monitors installed.
5. Enable Multi-Tenancy Mode: Once all monitors have been removed, navigate to Monitoring Status > Monitors Settings > Advanced Settings, and select Enable Multi-Tenancy mode.
   

For version 9.0, these steps are unnecessary because the Enable Multi-Tenancy mode checkbox has been removed. Monitors in version 9.0 no longer require connectivity to a local domain controller for authentication. In version 8.8, monitors used the domain identity for authentication. In version 9.0, each monitor uses a Monitor Access Key for authentication.

Step 2: Export the Certificate

1. On a machine in the management network, open the Certificate Manager (certlm.msc)
2. Under Personal > Certificates, right-click the controlupcert_[NameOfMSPOrg] > All Tasks > Export.
3. Follow the instructions on the screen and export the certificate to a file.
4. Copy this file to any tenant machine that runs the console.

Step 3: Import the Certificate on All Tenant Console Machines

Before linking your tenant to the multi-tenancy organization, you must import the certificate into the Certificate Store on all tenant console machines.

1. On the tenant machine, open the Certificate Manager by running certlm.msc.
2. Right-click on Personal, navigate to All Tasks, and select Import. Follow the prompts to import the certificate.
3. During the import process, select the Mark this key as exportable checkbox.
   
4. Verify that the certificate has been successfully imported.
   

Step 4: Connect the Tenant with the Management Organization

1. Open the console on the machine where you imported the certificate.
2. In the Select a ControlUp organization window, click Multi-tenancy login setup.
   
3. Select the certificate and click OK.
   
4. Select the management organization that this tenant belongs to and click OK.
   
5. The tenant will be linked to the Tenant in our backend, which may take about a minute. Once the tenant is linked, select the management organization and click OK again.
   
6. Enter the OTP code that you receive via email.

Step 5: Create a New Role for Each Tenant

1. Open the console on a management machine.
2. Under Security Policy, create a new role for each tenant.
3. Add a user or user group to the new role.
4. On the management machine, set the following permissions to Allow:
   1. View Folder
   2. Shared Credentials
   3. Use Solve / Use Web Application
      

Step 6: Add Tenant Credentials on Tenant Machine

1. On a tenant machine, go to Settings > Credentials Store > Add Credentials Set.
2. Add the tenant user so that the multi-tenancy and tenant credentials are visible.
   

Step 7: Create a Site for Each Tenant

1. Create a new site for each tenant.
2. On the tenant machine, add the user account for the tenant.
   
3. Once the user that was assigned the new role is added, click the Shared checkbox to make this a Shared Credential.
   

Step 8: Add Monitors to Sites

Each tenant (site) operates their own monitors that monitor data sources, which can include extensions or managed machines. These monitors usually reside within the specific tenant's network. Adding monitors to a site provides data segregation, ensuring that each tenant's data is isolated and managed independently.

To add monitors to a site:

1. On the tenant machine, click Settings > Monitors > Monitors Settings.

2. Under Domain Identity, click Import Console Credentials.
   

3. Once the credentials are imported, you will see the following popup:
   

   Important for 8.8

   Make sure that the domain you are currently in is Set as primary. After you are finished adding Monitors, it doesn't matter which domain is the primary domain when MSP mode is enabled.

4. Click Shared to make this credential a Shared Credential.
   

5. Once added, click Import AD Connection.
   

6. You should now see both, management and tenant domains.
   

7. At the top, select the tenant site and click Add Monitors to Site.
   

8. Ensure the correct site appears in the Site dropdown. Select the machine on which you want to install the monitors and click Install.
   

Post-Installation Tips

Assign the MSP admin the Login Access Manager role

Users that are assigned the Login Access Manager permission are allowed to add or remove email addresses. From version 8.8, Login Access Managers are granted the Roles Managers role automatically. Ensure that only the MSP admin is assigned the Login Access Managers role, and not the tenant admin. Assigning the tenant admin with this privilege could lead to the unauthorized addition or removal of machines in the management site.

The Roles Manager has the following permissions:

• Force encryption on the agent settings screen
• Edit/Reset role members
• Add/remove roles

Remove the View Folder Permission for Organization Members

After completing the previous steps, you are now ready to add the tenant's resources to ControlUp. It is recommended to create a dedicated folder for each tenant within the organization folder and assign all managed machines to their respective folders.

For each tenant folder:

• Uncheck the Inherit checkbox.
• Set the View Folder permission to Allow for the tenant that should see its own folder.
• Remove the View Folder permission for the Organization Members role.
  

Troubleshooting

Monitors unable to connect to the backend

If monitors throw an error such as Failed to authenticate using advanced authentication, check the following:

1. In the registry on your monitor machine, ensure that the value AdvancedModeCertificate located in S-1-5-20\Software\Smart-X\ControlUp\MonitorSvc contains the thumbprint of the certificate.
   

2. Additionally, ensure that the NETWORK SERVICE account has Full control permissions for the private key associated with the certificate. This is required because the ControlUp Monitors run with the NETWORK SERVICE account and need to be able to read the certificate. You can find more information here.