# Sub-organisations - Link: https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/sub-organisations/ - Published: 2026-08-24T01:47:17+00:00 - Author: Don Bowman 1. [Home](https://www.agilicus.com/) 2. [Agilicus AnyX Administrative Web Interface](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/) 3. [Organisation](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/) 4. Sub-organisations ![eb1da37a-featured-anyx-admin-organisationsub-organisations](https://www.agilicus. com/www/eb1da37a-featured-anyx-admin-organisationsub-organisations.png) ## Sub-organisations [CONTACT](https://www.agilicus.com/contact-us/) A **sub-organisation** is a child organisation under your own. Sub-organisations make your tenant multi-tenant: each one has its own organisation name, its own DNS subdomain, and its own billing and control scope, while you keep central administration from the parent. The **Sub-Organisations Overview** (route `/sub-org-admin`) lists them, and the **New Sub-Organisation** wizard (route `/sub-org-new`) creates them. ![Sub-organisations overview](https://www.agilicus.com/www/05ef5e1a-sub-orgs-overview- empty.png) ## Purpose The Sub-Organisations overview shows every sub-organisation under the current organisation with its contact and base URL. It is where you create new sub-organisations, delete ones you no longer need, and control whether a sub-organisation has its own identity issuer. The creation wizard takes you through the details step by step: what the sub-organisation is for, its name, its DNS domain, a review of the choices, and completion. ## Why use it * Separate departments, tenants, or partners while keeping central administration. See the web guide’s [Departmental sub-org setup](https://www.agilicus.com/anyx-guide/departmental-sub-org-setup/). * Give each sub-organisation its own billing and control scope. * Give a sub-organisation its own identity issuer, sign-in theme, or authentication policy (see [Enable Unique Issuer](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/sub-organisations/#enable-or-disable-a-unique-issuer)). * Isolate resources: resources and connectors are not shared across organisations, so a sub-organisation is the clean way to separate environments. ## When to use it * When a department or partner needs its own administrative control, users, and billing. * When you need a separate DNS domain for a group of users. * When you want a sub-organisation to authenticate through its own identity provider or policy. **Prerequisite**: you need user administration permission (a member of a `sys-admin` or `sys-users-admin` group, or equivalent). The screens show a _no permissions_ message otherwise. ## How to use it 1. Open **Organisation > Sub-Organisations Overview** from the left navigation. 2. The table lists existing sub-organisations with their contact email and base URL. An empty table (as in the screenshot above) means none exist yet. 3. Select **ADD SUB-ORG** to start the wizard (or use the **New** sub-menu under ** Organisation** in the left navigation). ![Sub-organisations with one row](https://www.agilicus.com/www/750b3012-sub-orgs- overview-populated.png) ### The New Sub-Organisation wizard The wizard has five steps. In this example an administrative grouping sub-organisation is created. **Step 1: Sub-Organisation type.** Choose what the new sub-organisation is: * **is a new customer**: the sub-organisation is a customer of yours, with its own identity issuer (a new customer with full identity separation). * **is an administrative grouping for my existing organisation**: a grouping for your own organisation that shares the parent’s identity issuer. ![Wizard step 1: type](https://www.agilicus.com/www/695e55c9-sub-org-wizard-step1- type-selected.png) Select the type, then select **Next**. **Step 2: Sub-Organisation name.** Enter the organisation, company, or account name. It can be up to 100 characters. ![Wizard step 2: name](https://www.agilicus.com/www/49818666-sub-org-wizard-step2- name-filled.png) Select **Next**. **Step 3: DNS domain.** Enter the (sub)domain the sub-organisation will use. * For a new customer sub-organisation with its own issuer, enter a fully qualified domain such as `cloud.example.com`. * For an administrative grouping, enter a name and the parent’s subdomain is appended( shown as a suffix, for example `guide-demo.dbt.agilicus.cloud`). The domain can be up to 63 characters with letters, numbers, hyphens, and periods. ![Wizard step 3: DNS domain](https://www.agilicus.com/www/848fa681-sub-org-wizard- step3-dns-domain.png) Select **Validate** to check that the CNAME record resolves and points to Agilicus. The progress steps **CNAME valid** and **CNAME correct** complete as each check passes. ![Wizard step 3: CNAME validated](https://www.agilicus.com/www/cd95de06-sub-org- wizard-step3-cname-validated.png) To use your own (sub)domain you need a wildcard CNAME record pointing from `*.subdomain. YOURDOMAIN.com` to the Agilicus regional domain. If you run split-horizon DNS, configure the record on both the internal and external servers. See [About DNS CNAME](https://www.agilicus.com/about-dns-cname) and the [Theory of operation: CNAME and domain](https://www.agilicus.com/anyx-guide/theory-of-operation-cname-domain/). If the CNAME does not resolve, the wizard shows an error dialog telling you to follow the instructions or wait for DNS propagation. ![Wizard step 3: CNAME error](https://www.agilicus.com/www/848fa681-sub-org-wizard- step3-cname-error-dialog.png) Select **Next** once the domain validates. **Step 4: Apply.** Review the summary: the organisation name and the full DNS domain. Select **APPLY** to create the sub-organisation, or **Back** to correct anything. ![Wizard step 4: apply](https://www.agilicus.com/www/b615d14e-sub-org-wizard-step4- apply.png) **Step 5: Done.** After the sub-organisation is created, the portal shows a success notification (`New sub-organisation "..." was successfully created`) and returns to the Sub-Organisations Overview, where the new sub-organisation appears in the table. ## Fields and controls reference ### Sub-Organisations Overview table | Column | Purpose | Notes | | Org Name | The sub-organisation’s name | Click a row to open the sub-organisation | | Org Contact | The contact email for the sub-organisation | | | Org Base URL | The HTTPS base URL of the sub-organisation | Built from the sub-organisation’s subdomain | ### Wizard fields | Field | Purpose | Required | Default | Valid values | Notes | | Sub-Organisation type | Whether the sub-organisation is a new customer or an administrative grouping | Yes | None | New customer; administrative grouping | A new customer can have its own identity issuer | | Organisation/Company/Account Name | The sub-organisation’s name | Yes | None | Up to 100 characters | | | (sub)domain | The DNS domain the sub-organisation uses | Yes | None | Up to 63 characters: letters, numbers, hyphens, periods | Validated with a CNAME check; a suffix is appended for administrative groupings | | Validate | Checks the CNAME record | n/a | n/a | n/a | Runs the CNAME valid and CNAME correct checks | ## Dialogs and popups ### Row actions Each row in the overview has an actions menu: * **Enable Unique Issuer** (when the sub-organisation shares the parent’s issuer): assigns the sub-organisation its own identity issuer. This changes the sign-in URL and lets you configure a custom identity provider, theme, and authentication policy for that sub-organisation. See [Can I configure a different policy for my sub-organisations?](https://www.agilicus.com/can-i-configure-a-different-policy-for-my-sub-organisations/) and the web guide’s [Sub-organisation issuer](https://www.agilicus.com/product-guide/sub-organisation-issuer). * **Disable Unique Issuer** (when the sub-organisation already has its own issuer): returns it to the parent’s issuer. ### Enable or disable a unique issuer Selecting **Enable Unique Issuer** or **Disable Unique Issuer** applies immediately and shows a success notification. Because the sign-in experience for the sub-organisation’s users changes, tell them before you enable it. ### Deleting sub-organisations Select the rows you want to remove, then select **DELETE SUB-ORGS**. Selected sub- organisations are marked as deleted and a notification confirms the deletion (`All selected sub-organisations were deleted`). Deleted sub-organisations can be revealed with the **Organisation Status > Show deleted organisations** filter in the table’s filter menu. ![Sub-organisations row selected](https://www.agilicus.com/www/ee7f67b2-sub-orgs- row-selected.png) ![Delete notification](https://www.agilicus.com/www/05ef5e1a-sub-orgs-delete-notification. png) ## Configuration versus diagnostics versus confirmation * **Configuration**: creating sub-organisations and enabling or disabling their unique issuers. * **Diagnostics**: the table is an inventory; there are no live diagnostic counters on this screen. * **Confirmation**: deleting sub-organisations applies immediately after you select the rows and press **DELETE SUB-ORGS**; there is no second confirmation step, so select carefully. Deletion is a soft delete recoverable through the _Show deleted organisations_ filter. ## Pagination and async behaviour * The overview table pages at 25 rows per page. Use the paginator to move through sub-organisations when there are more than 25. * Creation and deletion are asynchronous: after **APPLY** or **DELETE SUB-ORGS**, wait a few seconds and reload to confirm the change. Notifications confirm each action. * The table also refreshes membership data so the organisation switcher in the header reflects the new sub-organisation. ## Troubleshooting * **The CNAME validation fails**: check that the wildcard CNAME points to the correct Agilicus regional domain, that DNS has propagated, and that split-horizon DNS is configured on both servers. Retry **Validate** after the DNS change. * **The sub-organisation does not appear after creation**: wait for the notification and reload the page. * **I cannot enable a unique issuer**: confirm the sub-organisation currently shares the parent’s issuer; the menu shows the action that matches the current state. * **Users of a sub-organisation cannot sign in after enabling a unique issuer**: the sign-in URL changed to the sub-organisation’s own subdomain; communicate the new URL to its users. ## See also * [Organisation overview](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/overview/) * [Billing](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/billing/) * [Authentication policy](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/authentication/authentication-policy/) * [Glossary](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/glossary/) * [Identity and authentication](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/identity-and-authentication/) ## Web guide * [Organisation](https://www.agilicus.com/product-guide/organisation) * [Departmental sub-org setup](https://www.agilicus.com/anyx-guide/departmental-sub-org-setup/) * [Sub-organisation issuer](https://www.agilicus.com/product-guide/sub-organisation-issuer) * [Can I configure a different policy for my sub-organisations?](https://www.agilicus.com/can-i-configure-a-different-policy-for-my-sub-organisations/)