Organizations (MSP and multi-tenant)

Organizations is TridentStack Control's MSP mode. It lets one account manage several clients, sites, or business units, each kept separate from the others. If you are a managed service provider (MSP) or need multi-tenant management, this is the feature you are looking for.

Each Organization keeps its own endpoints, tags, policies, deployment rings, settings, and enrollment token. Your team signs in once and switches between Organizations from the Organization picker. Settings > Organizations is where you turn the mode on and manage your Organizations.

Turn Organizations on (MSP mode)

Organizations is off for every new account. To turn it on:

1. Open Settings and choose Organizations, in the Platform group.
2. Choose Enable Organizations.
3. Read the confirmation, then choose Enable Organizations again. You are asked to confirm your identity first.
4. The page reloads with Organizations turned on.

What happens when you turn it on:

• Everything you already have moves into a default Organization, named after your account with "(Default)" at the end. That includes your endpoints, tags, policies, deployment rings, and settings.
• Your existing installers keep working. Endpoints you install with them enroll into the default Organization.
• Your team keeps access to every Organization, unless you limit a user to some of them (see Control who can see each Organization).
• It is recorded in the System Audit log.

Before you start:

• You need the Manage Clients (MSP Mode) permission. The Owner and Admin roles have it. If you do not see the Organizations tab, ask an administrator in your account.
• If your account requires a second administrator to approve scripts, turn that requirement off first in Settings > Sign-on Settings, then turn it back on after Organizations is on.
• Turn it on from your own account, not while viewing another account.

You can turn Organizations off again later. See Turn Organizations off.

Add an Organization

1. In Settings > Organizations, choose Create Organization.
2. Enter the client's name, for example "Acme Corp", and choose Create.

The new Organization starts empty, with its own enrollment token. Use Rename to change its name, and Archive to hide one you no longer manage. Its endpoints stay where they are, and you can restore an archived Organization from Archived Organizations. The default Organization cannot be archived.

Enroll endpoints into an Organization

Every Organization has its own enrollment token, so each client's endpoints land in the right place.

• Choose Token next to an Organization in Settings > Organizations to copy its token.
• Or pick the Organization in the Organization picker and open Settings > Agent Installers. The installers and install commands there enroll into that Organization.

See Agent Enrollment for installing the agent on each platform.

Switch between Organizations

The Organization picker sits at the top of the sidebar once Organizations is on. If the sidebar is collapsed, expand it to see the picker. On a phone, it is under More. Choose it, then pick an Organization. Every page, from Endpoints to Reports, then shows only that Organization's data. There is no combined view across Organizations.

Control who can see each Organization

By default, every user in your account can open every Organization. To limit a user, for example a technician who only looks after one client:

1. In Settings > Organizations, choose Access next to the Organization.
2. Switch on the users who should have access.

A user with no grants can open all Organizations. Once you grant a user access to one or more Organizations, they can open only those.

Copy policies between Organizations

When you have built a policy in one Organization, you can copy it into any number of your other Organizations instead of rebuilding it by hand.

What you can copy

Page	What is copied
System Updates	The update policy with its approval and reboot settings
Policy Objects	The policy object with every setting inside it
Configurations	The application configuration with its applications and approval settings
Deployment Rings	The ring with its maintenance window, rollout phases, and safety settings
Tags	The tag's name, description, and sensitive setting. Endpoints are not copied
Endpoint Checks	The check policy with its groups and checks
Tags > Tag Automation	The automation rule with its conditions, schedule, and the tags it applies
Script Library	The script and its approved code, as a draft to approve in that Organization
Script Library > Automations	The automation with its triggers, settings, and values. Secret values are not copied

How to copy

1. Open the page and right-click the item, or open its row menu, then choose Copy to Organizations.... On a phone, Endpoint Checks and the Script Library offer it from the item's actions sheet.
2. Pick the Organizations to copy into, then choose Preview.
3. Review what will happen in each Organization, then choose Copy to N Organizations. You are asked to confirm your identity before the copy runs.
4. The results list each Organization. Choose Open to go straight to the copy in that Organization.

The menu item appears when Organizations is on, you can reach at least one other Organization, and you have permission to edit that kind of item. Copying a tag or a tag automation rule also needs the Assign Policies permission. Scripts and script automations can be copied only into Organizations that have Custom Scripts and are verified.

What happens in each Organization

• Copies arrive switched off. Nothing changes on any endpoint until someone switches the copy on in that Organization.
• Names that already exist are not overwritten. The copy gets a new name, such as "Workstations - Monthly (Copy)". The preview shows the final name.
• Tags and deployment rings are matched by name. If the other Organization has a tag or ring with the same name, the copy is linked to it. If not, the preview says so and the copy arrives without that link. Linking tags needs the Assign Policies permission.
• System update policies are never linked to tags by a copy. Link the tags yourself after you switch the copy on, so updates start only when you mean them to.
• A deployment ring is left unlinked if it covers different platforms in the other Organization, so a copy never changes which endpoints a ring reaches.
• Some items need something to exist first. For example, a check that looks for a tag needs that tag in the other Organization, and a configuration needs its applications there. The preview shows these as Cannot copy with the reason, and the other Organizations still go ahead.
• A copied script arrives as a draft. It runs nowhere until someone approves it in that Organization.
• A script automation needs its script there first, approved, with the same name. Copy the script, approve it there, then copy the automation. If that Organization approves automations before they run, the copy waits for that approval too.
• Secret values are never copied. If a script automation uses one, enter it again in that Organization. If the script requires it, the preview shows the automation as Cannot copy until you create it there yourself.
• A tag automation rule keeps only the tags that exist there. Tags with no match by name are left off and listed in the preview. If none of its tags exist there, the rule cannot be copied.
• Limits still apply. An Organization that is already at its limit for that kind of item is skipped.

Every copy is recorded in the audit log of the Organization it came from and of each Organization it went to. See System Audit.

Turn Organizations off

To go back to a single account, archive every Organization except one, then choose Disable Organizations in Settings > Organizations. Endpoints, policies, tags, deployment rings, Endpoint Checks, scripts, and custom packages from all your Organizations, archived ones included, move back into your account.

• The Organization you kept wins any clash. Its items keep their names and its default system update policy stays the default.
• Items that share a name are renamed, the same way a copy is, for example "Standard (Copy)" or "workstations-copy".
• One installer keeps enrolling new endpoints: the kept Organization's, or if it has none switched on, one from an archived Organization. The others stop enrolling. Endpoints they already enrolled are not affected.
• Settings that would repeat are kept once. An update blocked in two Organizations stays blocked, and a compliance exemption made in two Organizations is kept from the one you kept, or from the first one merged.