Concept
CSP Tenant Front Door
CSP tenants sign in once at the SCA and enter their dedicated appliance GUI and API with tenant scope, feature gates and isolation.
Overview
In the CSP edition, the SCA (Sendense Central Appliance) provides a single tenant front door: a tenant signs in once at the SCA and is taken straight into their own appliance's GUI and API, scoped to them.
The front door carries authenticated control only — it is a control-plane path, and backup data never transits the SCA. Each tenant is still served by their own SHA (Sendense Hub Appliance); the SCA adds the provider-facing front door and does not replace the tenant's SHA.
The tenant front door is a CSP-edition capability. In the MSP edition, where customers reach their own SHA directly, the tenant front-door routes are disabled.
Tenant Identity
Same Look And Feel
Both the tenant view and the operator view are the real appliance GUI — backups, restore, protection patterns, and dashboards — scoped to the tenant rather than a separate, cut-down interface.
No separate UI to learn
A tenant sees the same GUI an operator does, narrowed to their own appliance and entitlements. There is no distinct tenant application to build, document, or train against.
Tenant Self-Service Scope
Within their own appliance, a tenant can:
- Run backups on demand, and create and edit protection patterns, machine groups, and schedules.
- Choose which of the repositories already present on their appliance a pattern targets — but not create or register repositories; repository lifecycle stays provider-side.
- Recover data through restore: mount-based and file-level recovery, and full-VM restore.
- Advanced write actions such as restore-to-a-new-server and encryption-key management are deliberately excluded from tenant self-service.
Feature Entitlements
On a per-tenant basis, a provider can turn sellable add-on capabilities on or off. Only add-on capabilities are gated:
- DR and replication, off-site copy, file-level recovery, application-aware recovery, and clean-room validation are sellable add-ons a provider can enable or disable per tenant.
- Core capabilities are never gated — backups, full-VM restore, protection patterns, dashboards and monitoring, and identity are always available to every tenant.
- A feature change takes effect immediately, on the tenant's next request; there is no re-provisioning step.
Tenant Binding And Isolation
A tenant is bound to a single appliance. Which appliance a request reaches is resolved from the authenticated session, never from anything the caller can put in the request path, so a tenant can only ever reach their own appliance.
Only an approved set of tenant actions is allowed to reach an appliance at all (default-deny), and the front door carries authenticated control only — backup data never transits the SCA.
Suspension takes effect immediately
A tenant's active status is re-checked on every request, so suspending a tenant takes effect at once — including mid-session — without waiting for anything to expire.
CSP Operator Console
Provider operators work in the same appliance GUI with a top-level tenant selector: they pick a tenant and the GUI is scoped into that tenant's appliance.
Unlike a tenant's own scoped view, an operator gets the full appliance feature set for the selected tenant — the tenant self-service scope and per-tenant feature gates narrow what tenants do for themselves, not what the provider's own operators can do on their behalf.
Related Docs