Tenant administrator
You run a tenant: its members and roles, teams, configuration and the capabilities opened in it.
The tenant administrator runs a tenant's day-to-day governance: who is in this tenant, which role they hold, which team they are in, how the tenant is set up and which capabilities are open in it.
Most of your work happens on three screens. On the Members screen you add someone by email; if they aren't registered, a single-use invite valid for seven days is created. On the Roles screen you give a member one of the five archetypes. On the Capabilities screen you open and install a capability that the platform or your account has published.
Not every permission you see in your tenant comes from you. A role given in the account or on the platform also works in this tenant; the Access screen shows it as “Inherited”, and the place to take it back is the scope where it was given.
Start here
- From the Members screen, add someone to the tenant by email or invite them.
- Give a member one of the five role archetypes in the tenant; see the keys you granted on the role screen.
- On the Capabilities screen, open and install a capability that the platform or your account has published.
- Change a configuration value for this tenant; know that you cannot relax the floor set by the scope above.
- On the Access screen, see who holds which key, and which role and which scope it comes from.
Getting started
Concepts
- ConceptPlatform, account and tenant
- ConceptCapability, solution and activation: a capability's path
- ConceptRoles, permission keys and why an action was refused
- ConceptHow policy and configuration flow down: inheritance and floors
- ConceptParts of the console: menu, scope switcher, ⌘K, account menu and Help
- ConceptThe four states a screen can show
My account and security
Studio
Applications and data
- Screen guideCatalog
- Screen guideExplorer
- Screen guideAnalysis
- Screen guideNavigator
- Screen guideSheet
- How-toCorrect, delete and restore a record
- How-toLink, unlink and follow a record's relations
- How-toExplore the metadata model
- How-toImport a sheet and explore it before it becomes records
- How-toExplore roles, teams and capabilities
Tenant governance
- Screen guideMembers
- Screen guideRoles
- Screen guideAccess
- Screen guideConfiguration
- Screen guideData Governance
- Screen guideTeams
- Screen guideConfig Management
- Screen guideDomain & Application Management
- Screen guideApplications
- How-toAdd or invite someone to a tenant
- How-toGive a member a role in a tenant and revoke it
- How-toChange a configuration value in a tenant
Tenant design
Operations
Audit
When things go wrong
- CaseA section is in the menu but opens locked
- CaseA button is disabled, or was refused when pressed
- CaseThe value I wrote in the tenant was refused: the higher scope's floor
- CaseThe invite link opens but has expired
- CaseA capability's install is stuck on “Installing”
- CaseAn install failed, or never started
- CaseI signed in but no area opens
- CaseThe capability I want to open is not in the Capabilities list
- CaseThe screen says “This screen works in a tenant scope”
- CaseI can't revoke someone's permission here
- CaseI tried to give a role and it said “not a member”
- CaseI added someone to a team but they can't access anything
Troubleshooting
- Troubleshooting“You don't have access to this surface”
- Troubleshooting`NOT_PERMITTED: … default_deny_no_matching_rule`
- Troubleshooting“… cannot be weaker than the scope above's value”
- TroubleshootingThe invite page doesn't show an accept button
- TroubleshootingInstall error codes on the Capabilities screen
- TroubleshootingErrors when granting or revoking a role
- Troubleshooting“This screen works in a tenant scope” and similar
- TroubleshootingSession and sign-in errors