Organizations (multi-tenant)

ScoutDNS has two levels of multi-tenancy:

Level	Pattern	Best for
Account membership (default)	An operator can be a member of multiple separate accounts, each with its own role. Switch accounts via the selector at the top right.	Consultants and resellers who manage truly separate customers
Organizations (this article)	One parent account containing multiple sub-organizations. Each org has its own sites, profiles, policies, and users; the parent rolls up dashboards across all orgs.	MSPs and large enterprises who want per-tenant isolation with account-level reporting

What organizations do

1. Link sites and profiles to specific organizations, isolating their reporting.
2. View usage statistics by organization, with roll-up across all organizations from the parent view.
3. Create organization users who can only see and manage objects assigned to their organization.

How organizations work

Organizations are containers that you link sites and profiles to. Linking segments reporting and stats for those objects at the org level.

A site or profile must exist before you can link it. Build the site/profile first, then link.

Create an organization

1. Open the Organizations tab in the left nav.
2. Click New on the right.
3. Name the organization and click Save.

Link sites and profiles

1. Select the organization you want to populate.

2. In the Manage view, click Link under the org dashboard.

   

3. The picker shows both currently linked and unlinked sites/profiles.

4. Use the arrow to move objects from Unlinked to Linked.

5. Save.

Repeat for profiles. Same UI, same pattern.

[!IMPORTANT] A site or profile can be linked to one organization at a time. To move it elsewhere, unlink it from the current org first, then link it to the new one.

Organization dashboards

Statistics for linked sites and profiles are valid for the duration of the attachment. Switch between organizations via the org selector to see each one’s dashboard.

Organization selector

The organization selector sits to the right of the account selector at the top of the screen. Account operators can switch to any organization’s view; organization users can only switch between organizations they’re assigned to.

Selecting an organization filters every screen in the UI to show only that org’s data.

Account objects vs organization objects

Policies and custom lists behave differently depending on where they were created. This is the most common source of “wait, why can’t I edit this?” confusion.

Created from	Editable by	Visible to
All Organizations view (account-wide)	Primary-account operators only	Everyone (read-only for org users)
Organization view (a specific org)	Primary-account operators and org users with the right role	Primary account + that organization only

Implication: if you want org users to manage their own policies and custom lists, create those objects from inside the org’s view, not from the All Organizations view.

[!NOTE] Global allow/block lists are always account-level. They apply automatically to every policy across every organization and can’t be assigned to a policy (they’re already global). Org users can’t see or edit Global lists.

[!TIP] Use a consistent naming convention across sites, profiles, and other objects in every organization. Names like acme-hq-site, acme-roaming-profile, bigco-policy make the All Organizations roll-up view far easier to scan.

Template pattern for shared policies

Create the policy from the All Organizations view as a template, then copy it into each organization’s view. Each copy is then independently managed by that org’s users.

Organization tags

When you create a policy or list from within an org view, it gets an Organization tag. This signals the object is available to that org’s users. Primary-account admins can manage tagged objects from both the org view and the All Organizations view.

An organization user with the Manage role can edit account-level objects if those objects either have the org tag or were created by that user.

Organization user accounts

You can create user accounts scoped to specific organizations.

Org operators can be members of any number of orgs across any number of accounts. When they sign in, the org selector shows only the orgs they’ve been assigned to.

Role	Permissions
Manager	Create, edit, or remove objects within their assigned organizations
View	Read-only access to objects within their assigned organizations

[!IMPORTANT] Org operators are exempt from SSO. Even when SSO is enabled, org operators continue to use local logins. That’s deliberate, these accounts are intended for external organizations, partners, or end customers who shouldn’t be in your Entra tenant.

Related

• Add system users (role-based access), account-level RBAC
• SSO with Microsoft Entra ID
• Working with policies, template pattern for shared policies
• Setup and use guide for MSPs, MSP-specific deployment patterns