Sub-organisations
A sub-organisation is a child organisation under your own. Sub-organisations make your tenant multi-tenant: each one has its own organisation name, its own DNS subdomain, and its own billing and control scope, while you keep central administration from the parent. The Sub-Organisations Overview (route /sub-org-admin) lists them, and the New Sub-Organisation wizard (route /sub-org-new) creates them.
Purpose
The Sub-Organisations overview shows every sub-organisation under the current organisation with its contact and base URL. It is where you create new sub-organisations, delete ones you no longer need, and control whether a sub-organisation has its own identity issuer. The creation wizard takes you through the details step by step: what the sub-organisation is for, its name, its DNS domain, a review of the choices, and completion.
Why use it
- Separate departments, tenants, or partners while keeping central administration. See the web guide’s Departmental sub-org setup.
- Give each sub-organisation its own billing and control scope.
- Give a sub-organisation its own identity issuer, sign-in theme, or authentication policy (see Enable Unique Issuer).
- Isolate resources: resources and connectors are not shared across organisations, so a sub-organisation is the clean way to separate environments.
When to use it
- When a department or partner needs its own administrative control, users, and billing.
- When you need a separate DNS domain for a group of users.
- When you want a sub-organisation to authenticate through its own identity provider or policy.
Prerequisite: you need user administration permission (a member of a sys-admin or sys-users-admin group, or equivalent). The screens show a no permissions message otherwise.
How to use it
- Open Organisation > Sub-Organisations Overview from the left navigation.
- The table lists existing sub-organisations with their contact email and base URL. An empty table (as in the screenshot above) means none exist yet.
- Select ADD SUB-ORG to start the wizard (or use the New sub-menu under Organisation in the left navigation).
The New Sub-Organisation wizard
The wizard has five steps. In this example an administrative grouping sub-organisation is created.
Step 1: Sub-Organisation type. Choose what the new sub-organisation is:
- is a new customer: the sub-organisation is a customer of yours, with its own identity issuer (a new customer with full identity separation).
- is an administrative grouping for my existing organisation: a grouping for your own organisation that shares the parent’s identity issuer.
Select the type, then select Next.
Step 2: Sub-Organisation name. Enter the organisation, company, or account name. It can be up to 100 characters.
Select Next.
Step 3: DNS domain. Enter the (sub)domain the sub-organisation will use.
- For a new customer sub-organisation with its own issuer, enter a fully qualified domain such as
cloud.example.com. - For an administrative grouping, enter a name and the parent’s subdomain is appended (shown as a suffix, for example
guide-demo.dbt.agilicus.cloud).
The domain can be up to 63 characters with letters, numbers, hyphens, and periods.
Select Validate to check that the CNAME record resolves and points to Agilicus. The progress steps CNAME valid and CNAME correct complete as each check passes.
To use your own (sub)domain you need a wildcard CNAME record pointing from *.subdomain.YOURDOMAIN.com to the Agilicus regional domain. If you run split-horizon DNS, configure the record on both the internal and external servers. See About DNS CNAME and the Theory of operation: CNAME and domain.
If the CNAME does not resolve, the wizard shows an error dialog telling you to follow the instructions or wait for DNS propagation.
Select Next once the domain validates.
Step 4: Apply. Review the summary: the organisation name and the full DNS domain. Select APPLY to create the sub-organisation, or Back to correct anything.
Step 5: Done. After the sub-organisation is created, the portal shows a success notification (New sub-organisation "..." was successfully created) and returns to the Sub-Organisations Overview, where the new sub-organisation appears in the table.
Fields and controls reference
Sub-Organisations Overview table
| Column | Purpose | Notes |
|---|---|---|
| Org Name | The sub-organisation’s name | Click a row to open the sub-organisation |
| Org Contact | The contact email for the sub-organisation | |
| Org Base URL | The HTTPS base URL of the sub-organisation | Built from the sub-organisation’s subdomain |
Wizard fields
| Field | Purpose | Required | Default | Valid values | Notes |
|---|---|---|---|---|---|
| Sub-Organisation type | Whether the sub-organisation is a new customer or an administrative grouping | Yes | None | New customer; administrative grouping | A new customer can have its own identity issuer |
| Organisation/Company/Account Name | The sub-organisation’s name | Yes | None | Up to 100 characters | |
| (sub)domain | The DNS domain the sub-organisation uses | Yes | None | Up to 63 characters: letters, numbers, hyphens, periods | Validated with a CNAME check; a suffix is appended for administrative groupings |
| Validate | Checks the CNAME record | n/a | n/a | n/a | Runs the CNAME valid and CNAME correct checks |
Dialogs and popups
Row actions
Each row in the overview has an actions menu:
- Enable Unique Issuer (when the sub-organisation shares the parent’s issuer): assigns the sub-organisation its own identity issuer. This changes the sign-in URL and lets you configure a custom identity provider, theme, and authentication policy for that sub-organisation. See Can I configure a different policy for my sub-organisations? and the web guide’s Sub-organisation issuer.
- Disable Unique Issuer (when the sub-organisation already has its own issuer): returns it to the parent’s issuer.
Enable or disable a unique issuer
Selecting Enable Unique Issuer or Disable Unique Issuer applies immediately and shows a success notification. Because the sign-in experience for the sub-organisation’s users changes, tell them before you enable it.
Deleting sub-organisations
Select the rows you want to remove, then select DELETE SUB-ORGS. Selected sub-organisations are marked as deleted and a notification confirms the deletion (All selected sub-organisations were deleted). Deleted sub-organisations can be revealed with the Organisation Status > Show deleted organisations filter in the table’s filter menu.
Configuration versus diagnostics versus confirmation
- Configuration: creating sub-organisations and enabling or disabling their unique issuers.
- Diagnostics: the table is an inventory; there are no live diagnostic counters on this screen.
- Confirmation: deleting sub-organisations applies immediately after you select the rows and press DELETE SUB-ORGS; there is no second confirmation step, so select carefully. Deletion is a soft delete recoverable through the Show deleted organisations filter.
Pagination and async behaviour
- The overview table pages at 25 rows per page. Use the paginator to move through sub-organisations when there are more than 25.
- Creation and deletion are asynchronous: after APPLY or DELETE SUB-ORGS, wait a few seconds and reload to confirm the change. Notifications confirm each action.
- The table also refreshes membership data so the organisation switcher in the header reflects the new sub-organisation.
Troubleshooting
- The CNAME validation fails: check that the wildcard CNAME points to the correct Agilicus regional domain, that DNS has propagated, and that split-horizon DNS is configured on both servers. Retry Validate after the DNS change.
- The sub-organisation does not appear after creation: wait for the notification and reload the page.
- I cannot enable a unique issuer: confirm the sub-organisation currently shares the parent’s issuer; the menu shows the action that matches the current state.
- Users of a sub-organisation cannot sign in after enabling a unique issuer: the sign-in URL changed to the sub-organisation’s own subdomain; communicate the new URL to its users.