Octopus Tenant Manager Version 6.8.7 Release Notes

Overview

The Octopus Tenant Manager tool enables system administrators to easily manage multiple tenants within a Managed Service Provider (MSP).

This article describes the new features and enhancements available in Octopus Tenant Manager version 6.8.7.

New Feature

Cross-Tenant Shared Accounts [SSA-19770]

MSP administrators can now securely manage customer environments using a single enrolled identity, eliminating the need to enroll separately for each customer tenant while maintaining strong authentication and complete administrator accountability.

Benefits:

• Eliminates separate administrator enrollments for every customer tenant
• Simplifies administration across multiple customer environments
• Preserves customer isolation and strong authentication
• Maintains complete attribution of administrator activity through detailed audit logs

A Guest User from the MSP's Primary Tenant can be authorized to use a Shared Account that exists within a customer (Host) Tenant.

Guest Users can access user workstations within the Host Tenant and are authorized to access the Host Tenant's ADPA services, SAML services, and WS-Fed services.

Typical MSP scenarios include administering Windows workstations, servers, shared administrative accounts, and enterprise applications across multiple customer tenants without maintaining a separate enrolled administrator identity for each customer.

Configuration

To enable Cross-Tenant Shared Accounts:

1. Enroll the administrator in the MSP's Primary Tenant.
2. Assign the administrator to manage the Host Tenant in the Tenant Manager tool.
3. Open the Host Tenant's Octopus Management Console and navigate to the Account Sharing tab in the shared account's user details.
4. Enable account sharing and add the authorized MSP Guest Users.

Assignment to a shared account is configured in the Octopus Management Console of the Host Tenant. The Account Sharing tab within the Host Tenant's user details allows the system administrator to enable account sharing and maintain a list of authorized Guest Users.

Strong Authentication

Every shared-account authentication requires strong authentication, regardless of the Adaptive Authentication configuration in the Host Tenant's Management Console. This ensures that each cross-tenant administrative action is explicitly verified.

Guest Users must provide a verification code for every authentication to a workstation, service, or other supported resource.

Audit and Accountability

Audit logs preserve complete administrator accountability while allowing MSP personnel to use shared administrative accounts.

In the Audit menu of the Host Tenant's Management Console, each login event records:

• The username of the actual external MSP administrator
• The name of the administrator's Primary Tenant
• The username of the shared account used within the Host Tenant

Requirements

Current Limitations / Known Issues

The following role-related limitations will be addressed in a future release:

• After a user's role is changed from MSP Admin to MSP User and the user is removed from the Guest User list for a shared account, the user may still be able to authenticate via that shared account.
• When an MSP User's individual Tenant role has lower permissions than the Tenant role assigned through a group—for example, when the user's individual role is Helpdesk and the group role is Admin—the user is logged into the tenant with the permissions of the individual Tenant role rather than the group Tenant role.

Additional Information

For more information about shared accounts for MSPs, refer to the Octopus Tenant Manager Administration Guide.

Related Articles

• Octopus Tenant Manager Administration Guide
• MSP Shared Account Configuration
• Octopus Desk for Windows Version 4.3.6 Release Notes