MSP & Enterprise Overview

MCM is built around a two-tier model: MSPs operate the platform and serve multiple enterprise tenants, while each enterprise manages its own cloud accounts, users, and modules independently. This separation means MSPs can scale to many customers from a single console without logging into each one, while enterprises retain full control over their own environment.

---

The MSP Layer

MSPs access MCM through an operator console that spans all their enterprise tenants. From this single view, the MSP can:

• Provision and configure new enterprise organisations
• Define billing plans and assign them to enterprises, controlling which modules each enterprise can access
• Configure application branding — logo, colours, and application name — applied uniformly across all enterprise users
• Invite and manage MSP-level team members and assign them to specific tenants
• View users and module activity across all tenants from one place

---

The Enterprise Layer

Each enterprise is a self-contained tenant. Enterprise admins manage their own cloud accounts, invite their team, control role assignments, and view their billing — all within their scoped view. Enterprises can only see their own data and cannot access other tenants.

Enterprise users access the MCM modules included in their assigned billing plan: Discovery, FinOps, Governance, SecOps, Orchestration, and Observability.

---

Tenant Isolation

All data in MCM — resources, costs, security findings, policies, workspaces — is strictly isolated per enterprise. MSP admins can view tenant-level data for operational support but cannot act as an enterprise user or access data without explicit grants. This isolation applies at every layer of the platform.

---

Roles at a Glance