Multi-Tenant

[Git-Scram]

Hello, is there multi-tenant functionality or plans to implement multi-tenant in the future?

Thank you!

[DCMattyG]

Hi @nemisphere, much of the internal framework for Azure IPAM is already built to support multi-tenancy. Can you help me understand your specific use case better?

Are we talking about using it within a single "customer" whom has multiple Azure AD tenants, or are we talking about hosting it to support multiple "customers", each with their own unique Azure AD tenant?

[Git-Scram]

Hi @DCMattyG, thank you for your response, this is for a customer who has two tenants, they would like to be able see the vnets in both tenants within IPAM. Maybe I missed something when setting it up.

Thanks!

[Git-Scram]

Hi @DCMattyG, any update on the above?

Thanks!

[DCMattyG]

Hi @nemisphere, apologies for the delayed response. The IPAM application back-end has been built to support multi-tenancy, but there are some front-end changes that need to be made to implement it.

Is your desire to:

1. Have a single view of multiple tenant with all of the networks and such mixed into one view
2. Have a single app where you can dynamically switch between tenants for a tenant-level network view
3. Have a single application where multiple users can login from their respective tenant and manage their tenant-level network view

If option 1, can you extrapolate on that a bit for my better understanding?

Thank you!

[Git-Scram]

Hi @DCMattyG, thanks again for your help.

Option 1 would be what we are looking for:
We have two separate tenants that are managed by the same team but have some peerings between the two environments. We would like to discover all vnets and subnets in both environments in IPAM to ensure we have no overlaps, monitor IP usage, and to allocate blocks/reservations.

Hopefully this makes sense.

Thanks!

[DCMattyG]

@nemisphere, understood. In your case would you have a single account that exists in one of the two tenants AAD, then is a guest in the other....or would this be from 2 separate accounts, one from each respective tenant's AAD?

[Git-Scram]

@DCMattyG, It could be the first option, account in one tenant and guest in the other.

Thanks!

[DCMattyG]

Hi @nemisphere, I just wanted to let you know that I haven't forgotten about you, this ask has some levels of complexity to it.

When I originally stated that we have some multi-tenant capabilities built-in, that means more along the lines of users from multiple Azure tenants can share a single instance of Azure IPAM as we keep things separated by Tenant ID on the backend. We could even support a situation where a use who was part of multiple Tenants could actively switch between them, but still managing them separately.

What we hadn't thought of is where networking crosses between Tenants in the sense that one person would be trying to view that all at once between one or more Azure Tenants. The core issue is the sheer number of API calls because we would now need to multiply them by the number of Tenants as the Azure API's are really scoped at the Tenant level.

One thought could be the use of Azure Lighthouse, which I'm exploring. It does have support for Azure Resource Graph, which we use heavily. Have you explored Azure Lighthouse yet, or would you be open to exploring it for your current use case?

[benjamin-v1]

Hello @DCMattyG - I am in a similar situation, I have 2 tenants and would ideally like to only run one instance of IPAM. Each tenant has its own range so don't need to manage checking for overlaps, You say the backend is already set up for multiple tenants, but how would I configure IPAM to work discovering networks on both tenants?

[DCMattyG]

Hi @benjamin-v1, yes we did indeed build the platform such that it can support multiple tenants, however there are some additional implementation items required to truly support multiple Azure Tenants with a single Azure IPAM instance.

We have yet to design the onboarding process to give permissions for the Azure IPAM App Registration to additional Tenants. Additionally this solution leveraged Azure Resource Graph calls which are not something that really work across multiple tenants simultaneously, so the end experience would be a single Azure IPAM instance where you can toggle between Tenants, otherwise there will be an incredible number of API calls going to each connected Tenant and that may become a scale issue.

TL:DR - Despite the platform being designed to segregate data from multiple Tenants, we're still working on the exact implementation that would enable true multi-tenant utilization of the Azure IPAM platform. I'll definitely keep you in the loop as we get further down the road so we can work together on the end-user experience of both onboarding and day-to-day operations as well.

Apologies we're not further along here, but we want to make sure that the multi-tenant experience is as good as possible before we put anything out there in production.

[MarcoPetraliaDefra]

Hi @DCMattyG this is something we have also been looking for. Do you have a general time frame for implementing this feature? It's something we would like to implement as soon as it is ready.