MSP & Enterprise Overview
How MCM's two-tier MSP and Enterprise model simplifies multi-tenant cloud management at scale.
MSP & Enterprise Overview
MCM is built around a two-tier model: MSPs operate the platform and serve multiple enterprise tenants, while each enterprise manages its own cloud accounts, users, and modules independently. This separation means MSPs can scale to many customers from a single console without logging into each one, while enterprises retain full control over their own environment.
The MSP Layer
MSPs and enterprises share one unified console. For MSP users, it spans all their enterprise tenants. From this single view, the MSP can:
- Provision and configure new enterprise organisations
- Define billing plans and assign them to enterprises, controlling which modules each enterprise can access
- Configure application branding — logo, colours, and application name — applied uniformly across all enterprise users
- Invite and manage MSP-level team members and give them access to specific tenants
- Set up single sign-on for the organisation's staff
- View users and module activity across all tenants from one place
The Enterprise Layer
Each enterprise is a self-contained tenant. Enterprise owners and admins manage their own cloud accounts, invite their team, control role assignments, and view their billing — all within their scoped view. Access can be narrowed further, down to individual accounts, stacks, and dashboards. Enterprises can only see their own data and cannot access other tenants.
Enterprise users access the MCM modules included in their assigned billing plan: Discovery, FinOps, Governance, SecOps, Orchestration, and Observability.
Tenant Isolation
All data in MCM — resources, costs, security findings, policies, workspaces — is strictly isolated per enterprise. MSP administrators can view tenant-level data for operational support but cannot act as an enterprise user or access data without explicit grants. This isolation applies at every layer of the platform.
Roles at a Glance
| Role | What They Can Do |
|---|---|
| MSP Owner | Full control across the MSP — every enterprise and account, billing plans, dashboards, and domains |
| MSP Admin | Manage every enterprise and account across the MSP, without ownership-level delete actions |
| MSP Viewer | Read-only access across the MSP |
| Enterprise Owner | Full control of their assigned enterprises, including billing and users |
| Enterprise Admin | Manage accounts, modules, and users in their assigned enterprises |
| Enterprise Viewer | Read-only access to their assigned enterprises |
| Account Admin | Manage specific accounts and their modules |
| Account Viewer | Read-only access to specific accounts |