---
title: Access On Behalf Of Feature on Tenant Environment
slug: kronpam-reference-guide-3-9-0/access-on-behalf-of-feature-on-tenant-environment
description: Learn how to efficiently manage tenants using the On Behalf of feature. With this feature, you can handle multiple tenants seamlessly without the hassle of creating separate user accounts. Simply enable the feature in the Tenant Manager and grant necessar
docTags: 
createdAt: 2022-08-02T19:34:56.000Z
---

The **On Behalf Of **feature enables the management of tenants via SSO. When a tenant is created in a multi-tenant environment without this feature, the tenant admin has to create some users on the tenant environment, or integrate with LDAPor Microsoft Entra ID, to give those users some rights for management purposes.


Using the On behalf of feature, the tenant can easily be managed with the administrative accounts assigned by the host's admin users. The access on behalf of users are used on both the tenant and the host environments and are able to switch between different tenants (tenant-to-tenant, tenant-to-host or host-to-tenant) to manage them when defining the necessary rights on the tenant sides.

To enable this feature:

1.      Navigate to **Administration > Tenant Manager.**

2.      Click the **Select Action (**:inlineImage[****]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/EA4h-jxgBpmj4IO5ZwN1O_upload.png" alt caption width="33" height="27"}**)** button of the tenant, then click the **Edit Tenant** button on the Select Action modal. 

3.      At the bottom of the page, slide the toggle to the right to enable access **On Behalf of The Tenant**. After that, select the user directory source and then optionally fill the user and group filters in.

4.      Click the **Next **button.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/nQDXPtbnjXOwLtyOmwzWL_image.png "Figure – Enabling Access on Behalf of the Tenant")

After enabling this feature for the tenant, the host's admin user who manages the tenant needs the necessary rights on the tenant system. Please refer to [User Management](docId\:xq3wOV_mZRXULogeFGfY4) for details on how the host's admin users assign tenant's admin user right.

:::hint{type="info"}
To select “access on behalf users”, **LDAPDataCollectorJob** should be triggered on the **tenant** environment (either manually or in the predefined time). This job selects access on behalf of users for the tenant:

- from LDAP or Microsoft Entra ID Integration defined in the host environment, if the tenant creation screen **has blank **Group and User Search Phrases.
- from the tenant creation screen, if the tenant creation screen **has non-empty** Group and User Search Phrases.
:::

:::hint{type="info"}
**aioc.hide.on.behalf.of.tenant.switch **system config parameter is used in both tenant and host environmentsfor hiding the tenant-to-switch feature if the parameter is set as true. **The default value of this parameter is false**, which means that until this parameter is set as true, the access on behalf feature is used as in the usual scenario.

This parameter also affects the Desktop Client for the tenant switch feature.
:::