---
title: Step 3: Share accounts (optional)
source: https://docs.newrelic.com/docs/accounts/accounts-billing/account-structure/multi-tenancy/share-accounts
---

> #### ⚠️ IMPORTANT
>
> If you've set up a low-touch organization structure, this step doesn't apply to you. See the low-touch details in [Step 1: Create accounts and organizations](https://docs.newrelic.com/docs/accounts/accounts-billing/account-structure/multi-tenancy/org-creation).

Account sharing makes it possible for administrators in a managing organization to make the data they are monitoring visible to their managed organizations. After you've set up the initial account sharing in your high-touch organization structure (see [Create accounts and organizations](https://docs.newrelic.com/docs/accounts/accounts-billing/account-structure/multi-tenancy/org-creation)), you may find it necessary to make some follow-up changes.

Let's say you're an administrator in Betty's MSP (a managed service provider) who's monitoring a managed account for your customer Wayne Enterprises. You've also shared that account with the Wayne Enterprises organization. Here are some follow-up tasks you could perform:

**Create and share additional accounts**

If your customer Wayne Enterprises decides they want another account, here's what you'd do:

1.  Create another Wayne Enterprises account in your managing organization using the NerdGraph mutation `accountManagementCreateAccount`.
2.  If Wayne Enterprises also wants to see the data in the new account directly, you'd share that account with their organization using `organizationCreateSharedAccount`.

**Revoke access to a shared account**

If you decide there is no longer a need to share an account with your customer Wayne Enterprises, you can revoke the share with the mutation `organizationRevokeSharedAccount`. Note that this mutation requires the Account Share Id to be passed; see [here](https://docs.newrelic.com/docs/accounts/accounts-billing/account-structure/multi-tenancy/share-accounts/#find-orgs-for-account) for retrieving account share id's.

**Update the roles for a shared account**

If you need to change the user roles for any of the Wayne Enterprises shared accounts, you can use the mutation `organizationUpdateSharedAccount`. Note that this mutation requires the Account Share Id to be passed; see [here](https://docs.newrelic.com/docs/accounts/accounts-billing/account-structure/multi-tenancy/share-accounts/#find-orgs-for-account) for retrieving account share id's.

## Requirements [#requirements]

To use this feature, make sure you've completed the following for your organization:

1.  Get Approval: Contact your account representative to confirm your organization has been added to multi-tenancy. Once approved, you receive the multi-tenant entitlement.
2.  Make sure you have correct user types: Users within the managing org that will leverage the above feature set need to be provisioned as either a core or full platform users.
3.  Add users to appropriate group: Users with the core or full platform user type need to be added to a group with `tenant_settings` applied.

## What can you call in Nerdgraph? [#share-calls]

To help you get acquainted with account sharing, we have some basic examples below. First, take a look at the general routine:

1.  The source organization obtains the organization ID from the target organization. You can get the target organization ID from target organization users when they view their **Access Management** tab.
2.  The source organization calls the API and passes the target organization ID, account ID, and limiting role. The source organization can declare a limiting role which defines the maximum capabilities users from the target organization will be restricted to.

Here are the types of calls you can make for account sharing:

**Create a share**

To use this mutation, you should have already created the target organization. If that isn't in place yet, check out [Step 1: Create accounts and organizations](https://docs.newrelic.com/docs/accounts/accounts-billing/account-structure/multi-tenancy/org-creation).

```graphql
mutation {
  organizationCreateSharedAccount(
    sharedAccount: {
      accountId: ACCOUNT_ID_TO_SHARE
      limitingRoleId: 0
      targetOrganizationId: "CUSTOMER_ORGANIZATION_ID_HERE"
    }
  ) {
    sharedAccount {
      accountId
      id
      limitingRoleId
      name
    }
  }
}
```

**Revoke a share**

```graphql
mutation {
  organizationRevokeSharedAccount(
    sharedAccount: { id: "ID_OF_ACCOUNT_SHARE" }
  ) {
    sharedAccount {
      accountId
      id
      limitingRoleId
      name
      sourceOrganizationId
      sourceOrganizationName
      targetOrganizationId
      targetOrganizationName
    }
  }
}
```

**Find managed organizations with a specific shared account**

```graphql
{
  customerAdministration {
    accountShares(
      cursor: ""
      filter: { accountId: { eq: 1234 } }
      sort: { direction: ASCENDING, key: ACCOUNT_ID }
    ) {
      items {
        accountId
        id
        limitingRole {
          id
        }
        name
        source {
          id
          name
        }
        target {
          id
        }
      }
    }
  }
}
```

**Find accounts shared with a given managed organization**

```graphql
{
  customerAdministration {
    accounts(
      cursor: "",
      filter: {
        id: {eq: 1234},
        name: {contains: "text"},
        organizationId: {eq: "org-id"},
        sharingMode: {eq: SHARED_WITH_THIS_ORGANIZATION},
        status: {eq: ACTIVE}
      },
      sort: {direction: ASCENDING, key: ID}
    ) {
      nextCursor
    }
  }
}
```

**List roles**

```graphql
{
  customerAdministration {
    roles(filter: {organizationId: {eq: "ANY_ORG_ID"}}) {
      items {
        id
        name
        scope
        type
      }
    }
  }
}
```

**Update roles**

Use this mutation to change shared account roles. To find the roles of existing accounts, use the query in [List roles](#list-roles).

```graphql
mutation {
  organizationUpdateSharedAccount(
    sharedAccount: {
      id: "ID_OF_ACCOUNT_SHARE"
      limitingRoleId: NEW_LIMTING_ROLE_ID
    }
  ) {
    sharedAccount {
      accountId
      id
      limitingRoleId
      name
      sourceOrganizationId
      sourceOrganizationName
      targetOrganizationId
      targetOrganizationName
    }
  }
}
```