Skip to main content

Multi-Tenant Support (v8.240407)

Sysadmin
Sysadmin
Fluency Sysadmin

This release adds multi-tenant support: one Fluency site can hold up to 100 tenants, each with its own collectors, syslog ports and data platform. It also replaces the Microsoft OAuth authorization flow with an admin consent invitation. The release rolled out to all instances on April 7, 2024; multi-tenant mode is enabled site by site.

Changes​

Multi-tenant sites​

  • Tenants on one site. A site with multi-tenant mode enabled holds multiple tenants, up to 100. Site admins add, remove and list tenants from the new Tenant Admin menu.
  • Tenant view. A Tenant drop-down switches the site admin into a tenant's view, where they configure that tenant's platform — data sources, sinks, routers and processors — for all of the tenant's data.
  • Collection per tenant. Each tenant can have multiple remote collectors and multiple syslog import ports (TCP, UDP and TLS). The site's local collector is not used in multi-tenant mode.
  • Separate detection. Each tenant has its own EventWatch lookup engine and entity info tables, and its behavior events and behavior summaries are stored separately from other tenants'.
  • Tenant fields. Every event carries a new @tenant field, and behavior events and behavior summaries a tenant field.
  • In multi-tenant mode, the Event Parser and Device Management pages are removed.

The OAuth authorization workflow is replaced by an invitation, so a customer's Microsoft administrator can authorize Fluency without signing in to Fluency or joining a three-way call:

  1. A provider user sends the customer's administrator an email invitation that explains its purpose and links to the Fluency site with a unique invitation code.
  2. The administrator opens the link — access is granted by the invitation code alone — enters their Microsoft tenant ID, and approves the Fluency application and its roles in the Azure portal.
  3. Fluency sends a confirmation email, with instructions for removing the consent later.

Until the invitation is approved, the provider user sees each pending invitation and its result: failed, expired or success. A successful consent adds the integration to the Existing Integrations list, ready to add to the platform.

Platform​

  • Platform plugins. Cloud Integration plugins are being replaced by Platform plugins, which support multi-tenant mode.
  • Plugin API. A new Platform plugin API supports both event import and resource polling.
  • Collector. The Fluency Collector moves to a high-availability database.
  • Geolocation. The DB-IP geolocation database is updated.
  • Bug fixes.