CoreView Customer Care

Open a Support Case My Support Cases
Welcome
Login

4.E Understanding Virtual Tenants

I.  Overview

One of CoreView’s most mature functional competencies is its ability to allow the customer to partition or compartmentalize Office 365 data based on organizationally defined attributes.  These are known as Virtual Tenants.    


Why is this capability so important to organizations that have (or are moving) to Office 365?  Microsoft has designed Office 365 with a flat data structure.  For anyone familiar with Active Directory, it’s analogous to all of an organization’s account objects housed under a single Organizational Unit.  As a consequence of this design, it becomes especially difficult for organizations to manage and report on Office 365 data by business units.  Moreover, it creates significant challenges for organizations that desire to delegate the management of Office 365 to one or more business units.  Without a solution like CoreView, organizations often need to hire additional staff to cover the new Office 365 administrative activities.  You can find a brief video overview of this feature below.


II.   Filtering Office 365 Users

The scope of data associated with a CoreView Virtual Tenant can be configured to be as broad or as narrow as may be required by your organization.  As you can see from the screenshots below, you can configure a Virtual Tenant to limit data based on any or all of your organization’s UPN Domains, one or more specific Delegation Filter or any Groups.  


The term Filter is used simply to denote that you are filtering out (or in) that data which you want to associate with the Virtual Tenant you are creating (or editing).  Below is an overview of the page that is displayed when clicking on the Users tab, identified as "A" below.  This tab allows you to establish the scope (boundaries) of data associated with this Virtual Tenant.  The Filters applied under the Users tab apply only to user account objects. 


A. Users Tab


Any of the filters can be used alone or together.  The value of CoreView's filtering capability is that it can let you get control the degree and depth to which you can limit the scope of data to which an Operator has access using CoreView.   A Virtual Tenant can be as broad or as limited as may be needed by your Organization's business requirements.

 

B. Domain Filters


This Filter applies only to an account object's UPN Domain.  As shown in "E" above, you can search for a Domain by typing into the search field below the Column titled Domain and you can add a Domain to the Filter by clicking on the "+" icon.  Clicking on the "-" icon under removes a domain from the Filter.



C. Delegation Filters


The Delegation Filter allows you to specify how you want to limit the scope of data associated with any user (account) objects.  You first define the attribute you want to use, the filtering criteria and then the value(s) as depicted below.  Multiple filters can be used with an AND or an OR, as appropriate.



D. Distribution, Security and/or Office 365 Groups


For the purposes of this Knowledge Resource, we'll just use Distribution Groups in the example, because the same rules apply to Security or Office 365 Groups.  You can search for a Group by typing into the search field below the Column titled Display Name or Name.  You can add a Group to the Filter by clicking on the "+" icon. Clicking on the "-" icon under removes a Group from a Filter.



II.   Filtering Office 365 Groups

You can also specify what Groups you want to give Operators access in the context of a Virtual Tenant.   This can be configured to be as broad or as narrow as may be required by your organization.  As you can see from the screenshot below, you can configure a Virtual Tenant to limit access to Groups based on any or all of your organization’s UPN Domains, one or more specific Delegation Filters.  


A. Groups Tab


Below is a view of the Groups Tab along with a description of each Filtering option.



B. Domain Filters


Just like under the Users tab, this Filter applies only to an account object's UPN Domain.  You can search for a Domain by typing into the search field below the Column titled Domain and you can add a Domain to the Filter by clicking on the "+" icon.  Clicking on the "-" icon under removes a domain from the Filter.


C. Delegation Filters.


The Delegation Filter for Groups allows you to specify how you want to limit the scope of data associated with any of the three Group objects.  You first define the attribute you want to use, the filtering criteria and then the value(s) as depicted below.  Multiple filters can be used with an AND or an OR, as appropriate.




III. What's Next

Once you have created your Virtual Tenants, you then can delegate access to that tenant to any individual in your organization based on your business needs.  Please be aware that Virtual Tenants only work in the context of CoreView and are not a construct that is implemented in Office 365 itself.  This means that anyone to whom you’d like to delegate access will need to be enrolled in CoreView as an Operator and will need to log into CoreView to perform their Office 365 administrative (or analysis) activities.


We strongly recommend that TenantAdmins assign a new or modified Virtual Tenant to a test Operator account and then log in to CoreView using that test Operator account to validate that the configuration of the Virtual Tenant meets your expectations.


IV. License Pools as Virtual Tenants

Organizations also have the option to bypass the creation of Virtual Tenants and instead, configure CoreView to rely on your License Pool configuration as your Virtual Tenants.  This option is probably best for smaller customers whose plan for structuring your License Pools is that same as what you would want to use for Virtual tenants.  While we do make this option available, it's not a recommended practice.


---

Published: 03/15/2019

Updated: 11/11/2019


Did you find it helpful? Yes No

Send feedback
Sorry we couldn't be helpful. Help us improve this article with your feedback.