5.7 Subtenants

Subtenants is a multi-tenant segmentation of an existing Veeam Cloud Connect tenant, that can be used to split a Cloud Repository into multiple isolated repositories that share the same quota. If multiple agents use the main Tenant account to store their backups, they would be able to see each other data; since tenant’s administrators would prefer to guarantee data confidentiality to their users, subtenants can help to achieve this.

5.33: Logical design of Cloud Connect subtenants

When agents uses subtenants accounts, they can store their backups inside the same Cloud Repository, sharing the same quota, but at the same time they cannot access each other’s backups.

The Tenant’s administrator can fully manage his own cloud repository and share it among his users. This is possible because subtenants’s management can be done by both the service provider and the tenant primary account.

Subtenants creation and management for Standalone accounts

In order for the tenant to manage his subtenants, he needs to install Veeam Backup & Replication and register the service provider’s Veeam Cloud Connect. Another option is to use Veeam Service Provider Console, if the service provider is offering it. This is however out of the scope of this book.

Once the registration is completed, the tenant selects the registered service provider and then the Manage Subtenants option:

5.34: Subtenants management at the tenant’s side

With the Add button, the tenant’s administrator can create a new subtenant:

5.35: Standalone subtenant creation

and assign a quota:

5.36: Standalone quota assignment

Each subtenant receives his credentials, and a personal quota that is carved out from one of the Cloud repositories that the tenant has received from the service provider. Subtenants can have a personal limit, or share the overall limit of the Cloud repository until it is full (using the Unlimited setting for the quota). Personal quota are hard limits for the subtenants, but the tenant can oversubscribe his cloud repositories if needed. At the same time, the size of the Cloud repository is still a hard limit for the tenant, even if it’s oversubscribed.

From the management panel, tenants can add, edit or remove their own subtenants, and control the quota usage, without involving the service provider. This makes the solution highly flexible, giving full self-service capabilities to tenants and at the same time reducing the load on the service provider, which still has control over the overall quota.

5.37: Subtenant management panel

Subtenants creation and management for Cloud Director accounts

As explained in previous chapters, when Cloud Director is used in Veeam Cloud Connect, Veeam totally relies on existing objects instead of creating new ones. Even for subtenants this rules applies. In fact, if a service provider or a tenant open the subtenant management page and try to add a new subtenant, the window will be different than the one shown before:

5.38: Add subtenant with Cloud Director

Users cannot be created directly in Cloud Connect but they need to be selected from the existing Cloud Director users that are not organization administrators. For example, multiple vApp users can be created in Cloud Director directly by the tenant:

5.39: vCloud Director users

When the tenant goes to add a new subtenant in Cloud Connect, in the user selection he can see and select the vApp users retrieved in real time from Cloud Director:

5.40: List Cloud Director users in Cloud Connect

The rest of the configuration proceeds as explained for local subtenants:

5.41: Cloud Director subtenants

In the next chapter, we will see how subtenants can be used to run Veeam agents backups.