# Sub-organisations

1. [Home](https://www.agilicus.com/)
2. [Agilicus AnyX Administrative Web Interface](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/)
3. [Organisation](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/)
4. Sub-organisations

![](https://www.agilicus.com/www/eb1da37a-featured-anyx-admin-organisationsub-organisations.png)## Sub-organisations

[CONTACT](/contact-us/)

A **sub-organisation** is a child organisation under your own. Sub-organisations make your tenant multi-tenant: each one has its own organisation name, its own DNS subdomain, and its own billing and control scope, while you keep central administration from the parent. The **Sub-Organisations Overview** (route `/sub-org-admin`) lists them, and the **New Sub-Organisation** wizard (route `/sub-org-new`) creates them.

![Sub-organisations overview](https://www.agilicus.com/www/05ef5e1a-sub-orgs-overview-empty.png)    ## Purpose

The Sub-Organisations overview shows every sub-organisation under the current organisation with its contact and base URL. It is where you create new sub-organisations, delete ones you no longer need, and control whether a sub-organisation has its own identity issuer. The creation wizard takes you through the details step by step: what the sub-organisation is for, its name, its DNS domain, a review of the choices, and completion.

## Why use it

- Separate departments, tenants, or partners while keeping central administration. See the web guide's [Departmental sub-org setup](https://www.agilicus.com/anyx-guide/departmental-sub-org-setup/).
- Give each sub-organisation its own billing and control scope.
- Give a sub-organisation its own identity issuer, sign-in theme, or authentication policy (see [Enable Unique Issuer](#enable-or-disable-a-unique-issuer)).
- Isolate resources: resources and connectors are not shared across organisations, so a sub-organisation is the clean way to separate environments.

## When to use it

- When a department or partner needs its own administrative control, users, and billing.
- When you need a separate DNS domain for a group of users.
- When you want a sub-organisation to authenticate through its own identity provider or policy.

**Prerequisite**: you need user administration permission (a member of a `sys-admin` or `sys-users-admin` group, or equivalent). The screens show a *no permissions* message otherwise.

## How to use it

1. Open **Organisation > Sub-Organisations Overview** from the left navigation.
2. The table lists existing sub-organisations with their contact email and base URL. An empty table (as in the screenshot above) means none exist yet.
3. Select **ADD SUB-ORG** to start the wizard (or use the **New** sub-menu under **Organisation** in the left navigation).

![Sub-organisations with one row](https://www.agilicus.com/www/750b3012-sub-orgs-overview-populated.png)    ### The New Sub-Organisation wizard

The wizard has five steps. In this example an administrative grouping sub-organisation is created.

**Step 1: Sub-Organisation type.** Choose what the new sub-organisation is:

- **is a new customer**: the sub-organisation is a customer of yours, with its own identity issuer (a new customer with full identity separation).
- **is an administrative grouping for my existing organisation**: a grouping for your own organisation that shares the parent's identity issuer.

![Wizard step 1: type](https://www.agilicus.com/www/695e55c9-sub-org-wizard-step1-type-selected.png)    Select the type, then select **Next**.

**Step 2: Sub-Organisation name.** Enter the organisation, company, or account name. It can be up to 100 characters.

![Wizard step 2: name](https://www.agilicus.com/www/49818666-sub-org-wizard-step2-name-filled.png)    Select **Next**.

**Step 3: DNS domain.** Enter the (sub)domain the sub-organisation will use.

- For a new customer sub-organisation with its own issuer, enter a fully qualified domain such as `cloud.example.com`.
- For an administrative grouping, enter a name and the parent's subdomain is appended (shown as a suffix, for example `guide-demo.dbt.agilicus.cloud`).

The domain can be up to 63 characters with letters, numbers, hyphens, and periods.

![Wizard step 3: DNS domain](https://www.agilicus.com/www/848fa681-sub-org-wizard-step3-dns-domain.png)    Select **Validate** to check that the CNAME record resolves and points to Agilicus. The progress steps **CNAME valid** and **CNAME correct** complete as each check passes.

![Wizard step 3: CNAME validated](https://www.agilicus.com/www/cd95de06-sub-org-wizard-step3-cname-validated.png)    To use your own (sub)domain you need a wildcard CNAME record pointing from `*.subdomain.YOURDOMAIN.com` to the Agilicus regional domain. If you run split-horizon DNS, configure the record on both the internal and external servers. See [About DNS CNAME](https://www.agilicus.com/about-dns-cname) and the [Theory of operation: CNAME and domain](https://www.agilicus.com/anyx-guide/theory-of-operation-cname-domain/).

If the CNAME does not resolve, the wizard shows an error dialog telling you to follow the instructions or wait for DNS propagation.

![Wizard step 3: CNAME error](https://www.agilicus.com/www/848fa681-sub-org-wizard-step3-cname-error-dialog.png)    Select **Next** once the domain validates.

**Step 4: Apply.** Review the summary: the organisation name and the full DNS domain. Select **APPLY** to create the sub-organisation, or **Back** to correct anything.

![Wizard step 4: apply](https://www.agilicus.com/www/b615d14e-sub-org-wizard-step4-apply.png)    **Step 5: Done.** After the sub-organisation is created, the portal shows a success notification (`New sub-organisation "..." was successfully created`) and returns to the Sub-Organisations Overview, where the new sub-organisation appears in the table.

## Fields and controls reference

### Sub-Organisations Overview table

| Column | Purpose | Notes |
|---|---|---|
| Org Name | The sub-organisation's name | Click a row to open the sub-organisation |
| Org Contact | The contact email for the sub-organisation |  |
| Org Base URL | The HTTPS base URL of the sub-organisation | Built from the sub-organisation's subdomain |

### Wizard fields

| Field | Purpose | Required | Default | Valid values | Notes |
|---|---|---|---|---|---|
| Sub-Organisation type | Whether the sub-organisation is a new customer or an administrative grouping | Yes | None | New customer; administrative grouping | A new customer can have its own identity issuer |
| Organisation/Company/Account Name | The sub-organisation's name | Yes | None | Up to 100 characters |  |
| (sub)domain | The DNS domain the sub-organisation uses | Yes | None | Up to 63 characters: letters, numbers, hyphens, periods | Validated with a CNAME check; a suffix is appended for administrative groupings |
| Validate | Checks the CNAME record | n/a | n/a | n/a | Runs the CNAME valid and CNAME correct checks |

## Dialogs and popups

### Row actions

Each row in the overview has an actions menu:

- **Enable Unique Issuer** (when the sub-organisation shares the parent's issuer): assigns the sub-organisation its own identity issuer. This changes the sign-in URL and lets you configure a custom identity provider, theme, and authentication policy for that sub-organisation. See [Can I configure a different policy for my sub-organisations?](https://www.agilicus.com/can-i-configure-a-different-policy-for-my-sub-organisations/) and the web guide's [Sub-organisation issuer](https://www.agilicus.com/product-guide/sub-organisation-issuer).
- **Disable Unique Issuer** (when the sub-organisation already has its own issuer): returns it to the parent's issuer.

### Enable or disable a unique issuer

Selecting **Enable Unique Issuer** or **Disable Unique Issuer** applies immediately and shows a success notification. Because the sign-in experience for the sub-organisation's users changes, tell them before you enable it.

### Deleting sub-organisations

Select the rows you want to remove, then select **DELETE SUB-ORGS**. Selected sub-organisations are marked as deleted and a notification confirms the deletion (`All selected sub-organisations were deleted`). Deleted sub-organisations can be revealed with the **Organisation Status > Show deleted organisations** filter in the table's filter menu.

![Sub-organisations row selected](https://www.agilicus.com/www/ee7f67b2-sub-orgs-row-selected.png)    ![Delete notification](https://www.agilicus.com/www/05ef5e1a-sub-orgs-delete-notification.png)    ## Configuration versus diagnostics versus confirmation

- **Configuration**: creating sub-organisations and enabling or disabling their unique issuers.
- **Diagnostics**: the table is an inventory; there are no live diagnostic counters on this screen.
- **Confirmation**: deleting sub-organisations applies immediately after you select the rows and press **DELETE SUB-ORGS**; there is no second confirmation step, so select carefully. Deletion is a soft delete recoverable through the *Show deleted organisations* filter.

## Pagination and async behaviour

- The overview table pages at 25 rows per page. Use the paginator to move through sub-organisations when there are more than 25.
- Creation and deletion are asynchronous: after **APPLY** or **DELETE SUB-ORGS**, wait a few seconds and reload to confirm the change. Notifications confirm each action.
- The table also refreshes membership data so the organisation switcher in the header reflects the new sub-organisation.

## Troubleshooting

- **The CNAME validation fails**: check that the wildcard CNAME points to the correct Agilicus regional domain, that DNS has propagated, and that split-horizon DNS is configured on both servers. Retry **Validate** after the DNS change.
- **The sub-organisation does not appear after creation**: wait for the notification and reload the page.
- **I cannot enable a unique issuer**: confirm the sub-organisation currently shares the parent's issuer; the menu shows the action that matches the current state.
- **Users of a sub-organisation cannot sign in after enabling a unique issuer**: the sign-in URL changed to the sub-organisation's own subdomain; communicate the new URL to its users.

## See also

- [Organisation overview](/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/overview/)
- [Billing](/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/billing/)
- [Authentication policy](/anyx-guide/agilicus-anyx-administrative-web-interface/authentication/authentication-policy/)
- [Glossary](/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/glossary/)
- [Identity and authentication](/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/identity-and-authentication/)

## Web guide

- [Organisation](https://www.agilicus.com/product-guide/organisation)
- [Departmental sub-org setup](https://www.agilicus.com/anyx-guide/departmental-sub-org-setup/)
- [Sub-organisation issuer](https://www.agilicus.com/product-guide/sub-organisation-issuer)
- [Can I configure a different policy for my sub-organisations?](https://www.agilicus.com/can-i-configure-a-different-policy-for-my-sub-organisations/)