Designing Commcell as an MSP with Companies

Hi ​@danbj , 

You've raised several important questions about Commvault's multi-tenant design using companies I'll tired to clarify you points we call companies multi-tenant environments, where each tenant (company) is logically separated the reselleris intended for Managed Service Providers (MSPs) or aggregators who manage multiple companies (tenants) and may need to delegate administration or provide services to sub-companies.

1. Intended Design for Companies and Resellers

• Each company (tenant) is a separate logical entity.
• Resellers are a special type of company, typically used by MSPs to manage multiple companies. You can create a hierarchy: Parent company (reseller) → subcompanies (tenants).
• This is the intended design for MSPs or organizations supporting multiple independent entities

2. User Access Control Across Companies

• Users are added to user groups, and user groups are assigned security roles that control access.
• The Tenant Admin user group is created per company and has full permissions within that company.
• Users and user groups of a company are not allowed to associate with a role that grants permissions to the CommCell or to all servers the CommCell (global) user scope is separate from company (tenant) users

3. Where to Create Users and How to Delegate Access

• CommCell-level users: These are global administrators and are not intended to have direct access to company (tenant) data or resources.
• Company-level users: Users created within a company (tenant) have access only to that company s resources.
• Delegating access to multiple companies: There is no way to assign a single user account to multiple companies for direct data access. Each company is logically isolated for security and compliance reasons. 
• If a user needs access to multiple companies, you must create a user account in each company and assign the appropriate roles/groups. This is by design for strong tenant isolation

4. Delegating Full Company or Subcompany Access

• To delegate full access to a company or subcompany, add the user to the Tenant Admin group for that company.
• For access to multiple subcompanies, you must create a user in each subcompany and assign the necessary roles.
• There is no documented way to give a CommCell user direct access to company data; this separation is intentional.

This is a high-level overview, as covering all the technical details would require a much more comprehensive discussion. If you are working with a customer environment, I recommend engaging your Commvault partner or Commvault Account Manager. They can help you design and implement the solution according to your organization's security, compliance, and business requirements. Proper planning is important because an misconfiguration could impact your organization's data governance and compliance the NDA bro becarful.

If you need any assistance during the implementation, please feel free to reach out. I'll be happy to help where I can.

Good luck with your implementation

Thanks
Ramadan