Skip to main content

Instance vs. Tenant

Host Administrator

DataCentral is built on a multi-tenant architecture. This design allows a single deployment of the software to serve multiple, completely isolated organizations.

Understanding the distinction between an Instance and a Tenant is critical for Enterprise customers who host their own DataCentral environments, and for SaaS providers who use DataCentral to distribute data to their clients.

1. The Instance​

An Instance is the top-level, physical (or logical) deployment of the DataCentral application.

  • Scope: The Instance encompasses the web servers, the core database, and the overarching configuration that applies to all Tenants hosted within it.
  • Management: It is managed by a Host Administrator.
  • Responsibilities: The Host Administrator is responsible for:
    • Provisioning new Tenants.
    • Managing subdomains (e.g., client1.datacentral.ai, client2.datacentral.ai).
    • Defining "Editions" (feature bundles).
    • Configuring global Azure settings (if shared across tenants).
    • Monitoring global audit logs and system health.

2. The Tenant​

A Tenant is an isolated workspace inside the Instance.

  • Scope: A Tenant represents a single organization, business unit, or customer. It contains its own users, roles, Organizational Units (OUs), Power BI connections, and branding.
  • Management: It is managed by a Tenant Administrator.
  • Responsibilities: The Tenant Administrator is responsible for:
    • Inviting users and managing their access.
    • Importing Power BI reports.
    • Configuring Row-Level Security (RLS).
    • Customizing the Tenant's look and feel.

3. Isolation Model​

DataCentral enforces strict isolation between Tenants at the application and data layers.

  • Data Isolation: A user in Tenant A cannot see the users, roles, or reports in Tenant B. The API and the UI strictly scope all queries to the authenticated user's Tenant ID.
  • Database Options: By default, all Tenants within an Instance share the same underlying database schema (with logical separation via Tenant IDs). However, Enterprise deployments can be configured to use dedicated, physical databases for specific Tenants to meet strict compliance requirements.
  • Authentication Isolation: Each Tenant can configure its own Entra ID (Azure AD) integration. Tenant A can authenticate against CompanyA.onmicrosoft.com, while Tenant B authenticates against CompanyB.onmicrosoft.com.

4. Analogy: The Apartment Building​

A helpful way to understand the relationship is to think of an apartment building.

  • The Instance is the building itself. The building manager (Host Admin) handles the foundation, the plumbing, and deciding who gets to rent an apartment.
  • The Tenant is an individual apartment. The renter (Tenant Admin) has the key to their own door, can decorate the inside however they like, and decides who is allowed to visit. They cannot see into the neighboring apartments.