Tenants - RodrigoMattosoSilveira/EnterpriseRemoteSystems GitHub Wiki

In ERS, a tenant is not attached directly to the authentication account. Tenant access comes from the account’s linked authorization actor role grants.

To remove access to a tenant:

  • Log in as an Application Administrator other than the account being changed.

  • Open Authorization.

  • Find the authorization actor linked to the authentication account.

  • Under that actor’s role grants, locate the grant showing the tenant ID you want to remove, for example:

EXPENSE_OPERATOR · tenant-abc · TENANT

  • Click Revoke.
  • Revoke every grant for that tenant if the actor has more than one role there.

Important behaviors:

  • The authentication account remains active; only the selected tenant grant is deactivated.
  • You cannot revoke one of your own grants while operating as that actor.
  • If you revoke the actor’s final tenant grant, the user can still authenticate but will see No tenant access until another grant is assigned. This is an intentionally supported state.
  • An APPLICATION_ADMIN · * grant is global. You cannot exclude only one tenant from it; you would need to replace the global administrator grant with specific tenant-scoped roles.
  • For a TENANT_ADMIN assignment specifically, you may also open Tenants → selected tenant and revoke that administrator assignment. That removes only the tenant’s TENANT_ADMIN grant, not other roles the actor may have for the same tenant.

How can i easily find an active authorization actor that does not yet have an authentication account

Open Authentication → Create account as an Application Administrator.

The Authorization actor dropdown is already the easiest filtered list. It shows only actors that:

  • are active;
  • have at least one active role grant;
  • are not already linked to any authentication account.

Each option includes the actor’s display name, actor key, role, and tenant, for example:

Maria Silva (maria.silva) — EXPENSE_OPERATOR @ tenant-abc

Therefore, every actor appearing in that dropdown is a valid answer to active actor without an authentication account. ERS deliberately checks that an actor has usable tenant access before allowing account creation.

A few important details:

  • An actor linked to an inactive authentication account will not appear. Reactivate the existing account rather than creating another one.
  • An active actor with no active role grants will not appear.
  • If the dropdown says “No eligible authorization actors are available,” first create or activate the actor and assign an active role grant under Authorization.
  • After creating an account, that actor immediately disappears from the dropdown.