External Tenant Admin
“My colleague can see it and I cannot.” That sentence, and “a new starter signs in to an empty launchpad”, are settled in this folder. It holds one applet, Tenant Admin: the console where your own tenant’s owners and administrators decide who is a user, what is installed for each person, and which companies, branches and locations each role may act on. This page says who may open it, what it changes that the screen does not show, and where it stops.
Access: who opens this console, and on what authority
Rank OWNER or ADMIN on your tenant. Every user’s link to a tenant carries a rank (OWNER, ADMIN, MEMBER or GUEST), and Tenant Admin’s calls check for OWNER or ADMIN on the tenant you are signed into. The rank is held per tenant: one login can be ADMIN in your tenant and MEMBER in another, so an outside accountant who serves several clients administers only where each client made them ADMIN. BigLedger’s platform administrators also pass the install, uninstall and administrator calls.
Two decisions here need more than the rank. Putting a user into a role, and creating or editing roles from Settings, check for an owner or administrator permission inside the tenant, or a role assignment permission. An ADMIN with the rank alone is refused there, with a 403. The Tenant Admin page names the permissions.
Someone from outside your business (an accountant, an auditor, an implementation partner) comes in the same way as a colleague: their login is linked to your tenant at a rank, applets are installed for them, and a role decides what they can act on. Choose the rank deliberately. ADMIN lets them manage every user here, including you.
What changes behind the screen
- Installing an applet for someone can also make them a user. If the person was not yet in your tenant, the installation adds them at rank GUEST. Someone you never added yourself can become a user of your tenant this way.
- A permission set with no target confers access everywhere. Targets are the companies, branches and locations from the Organisation applet.
- The sidebar hides in Settings are tenant-wide. Hiding Tenant Roles hides it from the owner too.
- The audit trail you can open here is not the whole record. Role, permission-set and user-link changes are kept in a separate user audit trail, readable through the API, and applet installs and uninstalls in BigLedger’s own database. Neither appears on this console’s Audit Trail screen.
- Subscriptions are BigLedger’s. The Subscription menu lets you look a subscription up and delete it; changing one is done by BigLedger.
Which one to pick
- A new colleague or an outside accountant needs access: Tenant Admin, Catalogue › User › Add, then install their applets and give them a role. For a new tenant, or its first owner, go to your BigLedger contact.
- A person installs an applet for themselves: the Applet Store, from the catalogues they are offered.
- Another business’s own tenant should see part of yours, for example a franchisor or a sister group on a separate subscription: T2T Admin, which connects your tenant to the other one. Tenant Admin works inside yours.
- Tenants, their first owner, or the applet registry: BigLedger’s consoles, described on Platform.
When something here goes wrong
| What you see | Why | What to do |
|---|---|---|
| A new starter signs in to an empty launchpad | Linked to the tenant, with nothing installed for the login | Install from Platform Users › Available Applet, or let them use the Applet Store |
| “My colleague can see it and I cannot” | Different roles, or a set scoped to fewer branches | Compare the two roles’ permission sets and their targets before looking at the data |
| A branch supervisor can pick every branch in an applet’s filter | One of their roles holds, or once held, the tenant-wide owner or administrator permission, and the branch and location drop-downs show everything to it | Take that permission off the role. If it was removed already, see Troubleshooting |
| An ADMIN gets 403 putting a user into a role | Rank without the role assignment permission | Grant the permission to that administrator, or a role they hold |
| An auditor whose end date has passed still signs in | The end date on a login does not close access | Remove them from the tenant, then check they have gone from Tenant Users |
| A sidebar menu has gone for everyone, owner included | Its hide toggle was saved in Settings | Switch the toggle off and Save |
How you know access is right
A ten-minute review, worth doing each quarter and whenever someone leaves or an engagement ends. It belongs to whoever owns the tenant, not to the people being reviewed:
- Open Tenant Admins. Every OWNER and ADMIN should be someone you can name and still want there.
- Open Tenant Users and compare it with your staff list and the outside parties you have engaged. Remove anyone who should not be there, then reopen the listing to confirm they are gone. If they are still listed, ask BigLedger the same day.
- For each role, open its Permission Set tab, then each set it holds, and read the set’s Target Code. A set with none reaches every company, branch and location, which is right only for a role meant to.
- Keep your own dated note of who was given which role and why. The screen shows the current state; the history sits in an audit trail you read through the API or by asking BigLedger.
Where this applet sits
- Must exist first: your tenant and its first owner (set up by BigLedger); companies, branches and locations in the Organisation applet; applets placed in a catalogue your tenant has.
- What becomes possible: once a login is linked, installed and given a role, every functional applet opens with the menus, buttons and data that role allows.
- Siblings: the Applet Store installs for yourself, Tenant Admin for others; T2T Admin links tenants; Platform SysAdmin is BigLedger’s view of the same users and catalogues.
- Blast radius: an untargeted permission set reaches every branch; an outsider left at ADMIN can change everyone’s access; a hidden menu is hidden from the owner as well.
- Used together: Employee Maintenance for the employee-to-login link, and Teams and Permissions for the step-by-step.