Limitations for Moving and Acquiring Tenants Through Common Services
Table of Contents
Expand all | Collapse all
- Get Started with License Activation, Subscription, & Tenant Management
-
-
- First Time License Activation - One CSP Account
- First Time License Activation - Multiple CSP Accounts
- Return Visit License Activation
- Allocate Licenses for Cloud-managed Prisma Access
- Plan Service Connections for Cloud-managed Prisma Access and Add-ons
- Add Additional Locations for Cloud-managed Prisma Access and Add-ons
- Enable Available Add-ons for Cloud-managed Prisma Access
- Search for Subscription Details
- Share a License for Cloud-managed Prisma Access and Add-ons
- Increase Subscription Allocation Quantity
-
- Remote Browser Isolation Activation
- Product Management
Limitations for Moving and Acquiring Tenants Through Common Services
Learn about the limitations and caveats for moving internal tenants and acquiring
external tenants through Common Services.
| Where Can I Use This? | What Do I Need? |
|---|---|
|
|
The following limitations exist for managed security service providers (MSSP) or
distributed enterprises moving internal tenants and acquiring external tenants.
- You can acquire only the top-most, root-level, parent tenant hierarchies. You cannot acquire intermediate tenants within a hierarchy.
- You can't acquire tenant hierarchies with Service Provider Backbone enabled in the hierarchy.
- It's not recommended that a tenant hierarchy without a Service Provider Backbone enabled be acquired into a tenant with a Service Provider Backbone enabled. The action isn't blocked, but can have inconsistent results.
- You can't acquire a tenant hierarchy with Prisma SD-WAN licenses in the hierarchy at this time.
- Users with access to a tenant that acquires a new target tenant will gain access to the target tenant through inheritance.
- Tenant support contacts won't be changed during a move.
- A tenant with no support contact will inherit the new owner's contact.
- If a tenant is using a shared Cloud Identity Engine instance, you can't acquire it until the shared instance is removed.
- A tenant will keep all custom role definitions created on it.
- All service accounts created on a given tenant will stay with that tenant after being moved.
- If some but not all contact email addresses provided are valid tenant users, they will still receive the approval request email. Invalid emails will be ignored.
- Invalid acquisition requests will fail silently, they will look like successful requests to keep tenant information secret from the user.