Sendense Documentation

CSP Tenant Front Door

CSP tenants sign in once at the SCA and enter their dedicated appliance GUI and API with tenant scope, feature gates and isolation.

Documents Home

Concept

CSP Tenant Front Door

CSP tenants sign in once at the SCA and enter their dedicated appliance GUI and API with tenant scope, feature gates and isolation.

ReadyCurrentscacsptenant-portalfront-doorfeature-gating

Overview

In the CSP edition, the SCA (Sendense Central Appliance) provides a single tenant front door: a tenant signs in once at the SCA and is taken straight into their own appliance's GUI and API, scoped to them.

The front door carries authenticated control only — it is a control-plane path, and backup data never transits the SCA. Each tenant is still served by their own SHA (Sendense Hub Appliance); the SCA adds the provider-facing front door and does not replace the tenant's SHA.

The tenant front door is a CSP-edition capability. In the MSP edition, where customers reach their own SHA directly, the tenant front-door routes are disabled.

Tenant Identity

Local accounts
The SCA can hold tenant sign-in accounts directly, for providers who do not run their own identity provider.
Federated SSO (OIDC)
Where the provider runs an identity provider, tenants sign in through it via OIDC and the SCA validates the signed assertion; in this mode the SCA holds no tenant passwords.
Session isolation
A tenant sign-in yields a session that is only ever valid on that tenant's own surfaces — it cannot be used to reach staff or provider surfaces, and a staff or provider session cannot act as a tenant. When a session expires the tenant signs in again rather than being silently refreshed.
Login rate limiting
Repeated failed sign-in attempts are throttled; once the limit is reached the login asks the client to wait before trying again.

Same Look And Feel

Both the tenant view and the operator view are the real appliance GUI — backups, restore, protection patterns, and dashboards — scoped to the tenant rather than a separate, cut-down interface.

No separate UI to learn

A tenant sees the same GUI an operator does, narrowed to their own appliance and entitlements. There is no distinct tenant application to build, document, or train against.

Tenant Self-Service Scope

Within their own appliance, a tenant can:

  • Run backups on demand, and create and edit protection patterns, machine groups, and schedules.
  • Choose which of the repositories already present on their appliance a pattern targets — but not create or register repositories; repository lifecycle stays provider-side.
  • Recover data through restore: mount-based and file-level recovery, and full-VM restore.
  • Advanced write actions such as restore-to-a-new-server and encryption-key management are deliberately excluded from tenant self-service.

Feature Entitlements

On a per-tenant basis, a provider can turn sellable add-on capabilities on or off. Only add-on capabilities are gated:

  • DR and replication, off-site copy, file-level recovery, application-aware recovery, and clean-room validation are sellable add-ons a provider can enable or disable per tenant.
  • Core capabilities are never gated — backups, full-VM restore, protection patterns, dashboards and monitoring, and identity are always available to every tenant.
  • A feature change takes effect immediately, on the tenant's next request; there is no re-provisioning step.

Tenant Binding And Isolation

A tenant is bound to a single appliance. Which appliance a request reaches is resolved from the authenticated session, never from anything the caller can put in the request path, so a tenant can only ever reach their own appliance.

Only an approved set of tenant actions is allowed to reach an appliance at all (default-deny), and the front door carries authenticated control only — backup data never transits the SCA.

Suspension takes effect immediately

A tenant's active status is re-checked on every request, so suspending a tenant takes effect at once — including mid-session — without waiting for anything to expire.

CSP Operator Console

Provider operators work in the same appliance GUI with a top-level tenant selector: they pick a tenant and the GUI is scoped into that tenant's appliance.

Unlike a tenant's own scoped view, an operator gets the full appliance feature set for the selected tenant — the tenant self-service scope and per-tenant feature gates narrow what tenants do for themselves, not what the provider's own operators can do on their behalf.

Related Docs