Start with onboarding
Credentials match the customer
Tenant Profiles separate the endpoint and credentials for the same connected tool.
MSSP/MDR · Technology
Keep customer access in scope.
From the analyst to the AI.
Tenant context scopes supported views, API operations and connector credentials, for analysts and agents alike. Each customer's credentials sit encrypted in the Vault behind its own profile, so you can show a customer how its access is scoped.
Supported views and API operations scoped by tenantConnector credentials encrypted in Imperum VaultEach tenant keeps its own AI resources
Access ControlAll TenantsNorthstar
Access Control
M. KayaSecurity Analyst
NorthstarAuthorized customer scope
JuniperAuthorized customer scope
The customer scope shown is an example assignment.
Tenant Profiles
Microsoft SentinelNorthstar endpoint and credentialsNorthstar
Microsoft SentinelNorthstar endpoint and credentialsOktaJuniper endpoint and credentials
JuniperDifferent customers can configure separate credentials for the same tool.
Access Control
M. KayaSecurity Analyst
NorthstarAuthorized customer scope
JuniperAuthorized customer scope
The customer scope shown is an example assignment.
Alerts
Impossible travel sign-inMicrosoft Sentinel
HighMicrosoft SentinelPrivileged account activityIdentity source
QueuedThe selected context is Northstar. Visibility follows authorized customer scope.
Microsoft Sentinel- Tenant
- Northstar
- Endpoint
- Customer-specific
- Credentials
- Tenant-specific
- Workflow access
- Permissions apply
Tenant Profiles determines the connection used for the customer’s workflow.
Imperum Vault
- Connector
- Microsoft Sentinel
- Tenant profile
- Northstar
- Credentials
- Encrypted
- Secret access
- Permission required
Credentials are never handed to an agent directly.
Northstar
Case BookCustomer-scoped knowledge source
Triage HistoryCustomer-scoped knowledge source
ConnectorsCustomer-scoped tool access
Own data, credentials and AI resources. Appropriate AI modules required.
Juniper
Case BookCustomer-scoped knowledge source
Triage HistoryCustomer-scoped knowledge source
ConnectorsCustomer-scoped tool access
Own data, credentials and AI resources. Appropriate AI modules required.
Tenant context scopes supported views, API operations and connector credentials.
M. Kaya’s example assignment covers Northstar and Juniper.
Selecting Northstar brings its Alerts into the working context.
Northstar’s Microsoft Sentinel connection uses its tenant profile; credentials stay encrypted in the Vault.
Each tenant keeps its own data, credentials and AI resources. Agents operate within their authorized scope.
Illustrative customer workflow
01 - What it does
Make customer scope part of the workflow.
Serving several customers does not mean giving every operator the same access. Tenant context and permissions work together, with separate connection profiles for the tools each customer authorizes you to use.
Separate the customer’s connection details.
A connector can have a Tenant Profile for each customer, with its own endpoint and encrypted credentials. Supported views and API operations use tenant context, while permissions govern what a user or agent can reach. Authorized administrators may manage credentials across their permitted tenant scope. Review those grants alongside the profiles when agreeing a customer’s data boundary and deployment arrangement.
One connector serves every customer, each with its own credentials.
Northstar: access scopeExample
- Provider analyst
- M. Kaya
- Connector profiles
- 3 own profiles
- Credentials
- Imperum Vault
- AI resources
- Tenant’s own
Illustrative customer and configuration. Not customer performance data.
Access follows authorization
Users and agents reach the tenants, modules and actions their permissions allow.
02 - How it works in the product
Review the scope at each point of access.
Check the operator’s role, the selected tenant and the customer’s connection profile together. These controls determine access; a tenant label by itself is not the full architecture review.
- 01Access Control
Review Roles, Users and Permissions for the people serving the customer.
- 02Alerts
Select the customer in the header and inspect work within the operator’s permitted scope.
- 03Tenant Profiles
Configure the customer’s endpoint and credentials on its supported connector.
- 04Vault
Use the relevant permissions to manage stored connection secrets.
- 05Virtus Settings
Review model providers and routes for the AI workflows licensed for the customer.
Confirm each customer’s required data boundary, permissions and deployment arrangement during architecture review. AI capabilities require their module entitlements.
03 - How it connects
Carry the scope into tools and AI.
Integrations holds customer connection profiles. MCP Gateway controls which tools an AI may call, while AI Fabric keeps tenant AI resources and model routing in context.
Works with
In the editions
The Portal, Autonomous SOC and SecOps PlatformIncluded
Access controls apply to enabled modules; provider operations need the appropriate license.
04 - What it means for your service
Show customers a scope they can check.
When a customer asks how its data is kept apart, point to real controls: tenant context, permissions and its own connection profile. Agree the boundary before the workflow goes live.
Less credential duplication
A tenant profile supplies the customer’s access through a shared connector definition.
A scope you can review
Check the operator’s authorized customer scope and the permissions for each action.
A clearer customer agreement
Agree the data boundary and deployment arrangement against the workflows you will deliver.
Start with one customer
- 01Choose a customer workflow
Identify the views, tools and AI capabilities it needs.
- 02Review access together
Check the operator’s role and the tenant-specific connector profile.
- 03Validate the boundary
Confirm permissions and the deployment arrangement with the customer.
Questions about Tenant isolation.
1How is each customer’s data kept apart?
Multi-tenant mode uses tenant context to scope supported views, API operations and connector credentials. Customer profiles let you configure separate service connections. Authorized provider operators and administrators can access the customer scope assigned to them. Confirm the required data boundary, permissions and deployment arrangement for each customer during architecture review.
2Where do credentials live when an AI calls our tools?
The caller authenticates to the MCP Gateway separately from the credentials used for a connected service. Imperum resolves connector credentials from the Vault in the caller’s tenant context. Credentials for registered external MCP services are also stored encrypted and used to authenticate to those services. This lets the gateway manage service access centrally.
3Can an AI agent read another customer’s data?
Agents reach the tenants, modules, data and actions they are authorized for. Each tenant keeps its own data, credentials and AI resources. Review the agent’s permissions and tenant scope for the workflow you intend to enable; authorized provider access may span permitted customers.
Have any other questions? Talk to our team
The right customer.
The right access.
Review tenant scope, connector profiles and AI permissions against your service’s workflows.