Tenant administration

Tenant administration tasks are performed by system administrators and delegated tenant administrators.

System administrators must be members of the System Administrators role in the Cognos namespace. System administrators can view and modify all objects in the content store. They can also delegate tenant administration tasks to other administrators who are members of the Tenant Administrators role in the Cognos namespace.

Members of the System Administrators role can perform the following tasks in a multitenant IBM® Cognos® BI environment:

Create, change, and delete tenant objects.
Change tenancy properties on any object in the content store.
Move tenants.
Terminate sessions for tenants.

The Multitenancy tab in IBM Cognos Administration is the central area for tenant administration. On this tab, the administrator can view and manage all tenants that are registered in the current Cognos BI environment. Only members of the System Administrators role can access the Multitenancy tab.

Containment rules for multitenancy
Multiple tenants can co-exist in a single IBM Cognos content store. The tenant containment rules maintain security and ensure isolation between tenants. These rules dictate how the content is created and where it can be located.
Creating tenants in IBM Cognos Administration
System administrators must create a tenant in IBM Cognos Administration before the tenant users can access IBM Cognos Business Intelligence.
Assigning tentant IDs to existing content
After multitenancy is enabled, the system administrator assigns tenant IDs to the existing content store objects. All objects that belong to a tenant have the same tenant ID. The tenant IDs are created when a user from a specific tenant logs on to IBM Cognos Business Intelligence, or the system administrator impersonates the tenant. Tenant IDs can also be created using the software development kit.
Setting a tenant ID for a public object
You can assign a tenant ID for objects whose parent is public.
Impersonating a tenant
As a system administrator or a tenant administrator, you can impersonate a single tenant to view and interact with the content from the tenant perspective. When impersonating a tenant, you can perform all tasks that this tenant is allowed to perform and remain logged on to the system.
Delegated tenant administration
System administrators can delegate tenant administration tasks to members of the Tenant Administrators role.
Setting up virtual tenants to enable content sharing among tenants
When you set up virtual tenants, the objects in the content store can be accessed by users who belong to different tenants.
Displaying the tenant name in Cognos BI user interface
You can specify whether users without administrative permissions can view the tenant name in the Cognos BI user interface.
Managing tenant user profiles
Each tenant can have its own default user profile that is shared by all tenant users.
Tenant content deployment
You can export and import the tenant content.
Terminating active user sessions for tenants
You must terminate the tenant active user sessions before deleting a tenant or before performing some tenant maintenance operations.
Disabling tenants
You can disable a tenant when you want to prevent the tenant users from accessing IBM Cognos BI and modifying the tenant content. This should typically be done before deploying a tenant and all of the tenant content.
Deleting tenants
You can delete a tenant from IBM Cognos Business Intelligence. This might be needed if the tenant was permanently moved to a different instance of IBM Cognos BI.
Creating and running content store utilization tasks
Content store utilization tasks provide insight into the content store usage.
Creating and running a content store consistency check
You can run a consistency check to detect instances of objects that violate the containment rules for multitenancy. Content that does not follow the tenant containment rules might not be accessible to the intended users or might not be deleted when the tenant that it belongs to is deleted.
Access to interactive activities in a multitenant environment
The content of interactive activities in IBM Cognos Business Intelligence is not filtered by the tenant ID. Therefore, additional measures are required to restrict access to interactive activities for users.
Index search and multitenancy
Only a single search index can be created for all tenants. The content that is indexed is determined by the user who runs the index update task. Only content that is visible to that user is indexed. Therefore, this task should be performed only by a member of the System Administrators role from the Cognos namespace.

Parent topic: Multitenant environments