40.4 Decommissioning Tenants

If a tenant's contract ends, you can restrict tenant access to the Sentinel server by disabling the tenant. When you disable a tenant:

  • All users associated with that tenant can no longer access the Sentinel server or use any of the REST APIs.

  • Data collection continues until the tenant stops sending data or until you have disabled the relevant data collection nodes.

  • MSSP users associated with the default tenant will no longer see the disabled tenant in Sentinel functions where they could choose a tenant. For example, when creating real-time views or setting the tenancy for a role.

  • You can still see the disabled tenant in the Tenants interface and when you select Show disabled.

You cannot delete tenants because MSSP employees may want to run reports for a disabled tenant or verify whether they are still receiving events from a disabled tenant.

To disable a tenant:

  1. From Sentinel Main, click Users > Tenants.

  2. In the list of tenants, click Disable for the tenant that you want to disable.