Docs / Security & access

Administering a tenant

For whoever administers a tenant: the person who lets colleagues in, decides what its environments may reach, and is asked when an agent needs more than it has.

A tenant administrator holds the whole of one tenant and nothing outside it. Who the roles are, how somebody is invited, what a token is and what the second factor does are on People and access; this page is what being the administrator of a tenant actually asks of you.

The three switches that are yours alone

Every environment carries three settings that no token can change, only a person signed in to the browser:

• Allowed egress ranges — the private address ranges this environment may call outward. Empty is the default and means none: only public addresses are reachable. Cloud metadata addresses are refused whatever you list.
• Allowed egress hosts — the hosts this environment may reach at all. Empty means any, and a non-empty list is an opt-in allow list covering API calls, token endpoints and mail servers alike.
• Allow write probes — whether a machine credential may fire a configured call that changes data at a far end, one acknowledged request at a time. Off by default. Reads never need it.

They sit together because they answer one question: how far a credential somebody else holds may reach. That is also why a token cannot set them. A token that could open the gate protecting against token holders would not be a gate — so these live on a surface only a browser session reaches, and a token presenting itself there is refused whatever its scope.

Each of the three is recorded when it changes, with who changed it, which environment, and the value it now holds. That trail is the first thing an incident review asks for, and the act of opening a gate is as worth recording as anything done through it.

The write-probe switch is the one you will be asked about. An agent working in your sandbox can read anything it is pointed at; firing a call that writes needs this switch and an acknowledgement in the request itself. Turning it on for production is a decision, not a convenience.

What you can do, and what you cannot

You administer one tenant: its environments, its people’s access to them, and its work.

• Let somebody into an environment — give them a role on it, or change the role they have.
• Reset a member’s password, and clear a member’s lost second factor — for your own members, never for somebody whose access lies outside your tenant.
• Manage the work: hold, stop and replay, discard a dead letter, clear a whole environment’s health marks. Those acts are on When the work jams and When something is wrong.
• Manage the people who call your environment’s doors — a different population entirely, on App users.

Two things look like yours and are not. Taking an environment grant away is the installation administrator’s, not a tenant administrator’s — you can give access and change it, and removing it is asked for. So is making somebody a tenant administrator: that is a decision about who else holds what you hold, and it is made a rung above you.

Two environments, and only two

A tenant is created with exactly two environments, sandbox and production, and they are made together when the tenant is. There is no control that adds a third, renames one, or deletes one — not hidden somewhere, not anywhere.

This is worth saying plainly because everything else about an environment invites the opposite belief: it is a thing you have, it has settings, it appears in a list. It is not a thing you create. If you need a separate place to work, that is a second tenant.

The trail

Every environment keeps a record of what was done to it and by whom: who activated a version, who promoted, who restored, who cleared a health mark, who replayed an event, who was given access to what, and each of the three switches above. Entries are appended and never edited — the record is what is left of an act after the act, which is exactly why acknowledging a health mark or discarding a dead letter is worth recording: both destroy their own evidence.

Read it in the environment’s own log. An auditor’s grant is enough to read it, which is the point of that role existing.

Two things it deliberately does not hold: the payload of anything, and any credential. It says a connection’s secret changed; it never says to what.

An automated browser test performs part of this page’s acts against a running platform, every time the product changes — a tenant is created, renamed with the warning about its addresses, and deleted behind a typed confirmation whose dialog says what survives and what does not.