Step 2: Manage users and access

When setting up multi-tenancy, you can use delegated administration to make user or access management changes within other managed organizations. In the case of managed service providers, delegated administration allows you to manage users and access on behalf of your end customers.

Requirements

As a reminder, to use the multi-tenancy feature, make sure you've completed the following for your organization:

Get Approval: Contact your account representative to confirm your organization has been added to multi-tenancy. Once approved, you receive the multi-tenant entitlement.
Make sure you have correct user types: Users within the managing org that will leverage the above feature set need to be provisioned as either a core or full platform users.
Add users to appropriate group: Users with the core or full platform user type need to be added to a group with tenant_settings applied.

What can you call in NerdGraph?

Once you confirm that you meet the requirements for multi-tenancy, you can call our NerdGraph queries and mutations for managing users in managed organizations.

You'll be able to query all customerAdministration fields and execute a variety of mutations:

Use this mutation to grant access to a group. To find the roleID, see List roles.

mutation {
  authorizationManagementGrantAccess(
    grantAccessOptions: {
      groupId: "11111111-1111-1111-1111-111111111111"
      accountAccessGrants: {
        accountId: YOUR_ACCOUNT_ID
        roleId: "YOUR_ROLE_ID"
      }
    }
  ) {
    roles {
      displayName
      accountId
    }
  }
}

mutation {
  authorizationManagementRevokeAccess(
    revokeAccessOptions: {
      accountAccessGrants: {
        accountId: YOUR_ACCOUNT_ID
        roleId: "YOUR_ROLE_ID"
      }
      groupId: "YOUR_GROUP_ID"
    }
  ) {
    roles {
      accountId
      displayName
    }
  }
}

mutation {
  userManagementCreateGroup(
    createGroupOptions: {
      authenticationDomainId: "YOUR_AUTH_DOMAIN_ID"
      displayName: "GROUP_DISPLAY_NAME"
    }
  ) {
    group {
      displayName
      id
    }
  }
}

mutation {
  userManagementAddUsersToGroups(
    addUsersToGroupsOptions: { groupIds: ["II"], userIds: ["3"] }
  ) {
    groups {
      id
      displayName
      users {
        totalCount
      }
    }
  }
}

mutation {
  userManagementRemoveUsersFromGroups(
    removeUsersFromGroupsOptions: {
      groupIds: [YOUR_GROUP_IDS]
      userIds: [YOUR_USER_IDS]
    }
  ) {
    groups {
      displayName
      id
    }
  }
}

Use this mutation to create a new user. To find the authenticationDomainId, see Query authentication domains.

mutation {
  userManagementCreateUser(
    createUserOptions: {
      authenticationDomainId: "B"
      email: "a@b.c"
      name: "A B C"
    }
  ) {
    createdUser {
      id
      email
      name
    }
  }
}

{
  customerAdministration {
    authenticationDomains(filter: { organizationId: { eq: "Y" } }) {
      items {
        id
        name
        provisioningType
        authenticationType
      }
    }
  }
}

Step 1

Create accounts and organizations

Step 3

Share accounts (optional)

Step 2: Manage users and access

Requirements

What can you call in NerdGraph?

Grant access to user group

Revoke access to user group

Create user group

Delete user group

Add user to a group

Remove user from a group

Modify group name

Create new user

Delete user

Query authentication domains

List roles

Step 1

Step 3

Step 2: Manage users and access

Requirements .css-21sua1{background:none;border:none;width:0;padding:0;}

What can you call in NerdGraph?

Revoke access to user group

Create user group

Delete user group

Add user to a group

Remove user from a group

Modify group name

Create new user

Delete user

Query authentication domains

List roles

Step 1

Step 3

Requirements