Solution for managed IT providers

Multi-tenant MSP workspaces: every client isolated, none mixed

Use tenant-scoped workspaces, support access approvals, and owner controls to manage client IT operations safely.

Isolation
Separate every client workspace
Routing
Route users to the right subdomain
Access
Control modules and support access per tenant
Best fit

Who this is for

01

MSPs and IT service providers

02

Teams managing multiple companies

03

Operators who need client separation

How it works

  1. 01

    Create a workspace per client

    Each client company is a distinct tenant on its own subdomain with row-level security, so client data is never mixed and every workspace stands alone.

  2. 02

    Onboard client endpoints

    Deploy the RMM agent to ingest inventory, patch state and discovery data, enrol devices in MDM across Windows, macOS, Linux and Android, and manage updates in rings with patch management.

  3. 03

    Control how your team enters a client tenant

    MSP staff use the support-access approval workflow: access is requested, approved by the client owner, time-boxed and fully audited — no standing access into client data.

  4. 04

    Deliver security per client

    Scope a separate VAPT engagement to each client’s allowed_hosts, run scans, and hand back a per-client HTML or PDF report.

  5. 05

    Operate and report by tenant

    Run an SLA-aware helpdesk, server and website monitoring, and per-tenant reports and activity logs so each client sees only their own operations.

“

A worked example

Say an MSP serves 30 client companies from one console. Each client is its own tenant on its own subdomain, so a technician inside Client A’s workspace cannot see Client B at all. The RMM agent reports 14 machines at one client missing a critical patch, and the update rolls out in rings that evening. When an engineer needs deeper access, the client owner approves a time-boxed support session and every action lands in the audit log. Each quarter the MSP scopes a separate VAPT engagement per client and hands each one its own PDF report.
Outcomes

What the workflow improves

Separate every client workspace

Route users to the right subdomain

Control modules and support access per tenant

Modules used

Real product areas behind this solution

Tenant approvals

Support access

Server monitoring

Tickets

Assets

Billing controls

Every client is a separate tenant on its own subdomain with row-level security in the database, and cross-tenant isolation is verified by automated tests on each release, so there is no path for one client’s data to reach another.

Run thirty clients like thirty clean rooms

Tenant-per-client isolation, approval-gated support sessions and per-client VAPT reports let you scale managed services without ever mixing two customers’ data.