UniFi multi-tenancy

How UniFi's concepts of sites, Admins, and Super Admins work

Alex Lowe avatar
Written by Alex Lowe
Updated this week

Learn what multi-tenancy is within UniFi, what the user roles mean, how to set them up and then, how to manage users for multi-tenancy.

Contents

What is UniFi multi-tenancy?

Using multi-tenancy in UniFi gives you the ability to have one single cloud server, such as a UniFi server from HostiFi and then have completely separated networks called "sites". Each one of these sites could be used for separate customers and locations and each site is separate from one another. The wireless SSIDs, and VLANs, only exist within that site and are only applied to the devices adopted to that site.

In addition, a site can have separate admin accounts which can only view the site or sites they have permissions for.

The multi-tenancy ability in UniFi is what makes cloud hosted UniFi a great idea. Instead of having to manage dozens of Cloud Keys or local UniFi instances, each network can exist on a single cloud server as separate sites. For this reason, there is usually no need to purchase multiple HostiFi servers for your different customers or locations because they can all coexist on one server.

When creating admin accounts in this guide, we won't discuss setting up 2FA, but we do highly recommend you configure that for all of your Super Admin and Admin accounts.

What the user types mean

At the moment, the user roles are different between the Legacy UI and the New UI. For example, in the Legacy UI, it is possible to assign a user the rights to have ready only access to all of the sites, but within the New UI, everything is done on a site-by-site level and the 'global' access isn't possible to set in one click.

View Only / Read Only

If you have a customer or user who needs UniFi access, but you want to limit their view when they log in to see only a certain site or sites, you would create an Admin for them on the site. If they have multiple sites and you want them to be able to access all of their sites, you would create the Admin on one of the sites, and then "Invite existing admin" on their other sites. You can also choose to create a Read Only Admin, or limit some of the Admin permissions.

Typically you won't want to give an Admin access to any "Global Permissions", which can effect other settings outside of their site on the server, although it is possible to do so if needed.

Site Administrator

Typically for the technicians who are servicing all of the networks, you would want to give them a Super Admin account which has unrestricted access in UniFi.

Super Admins

What is a Site?

Sites represent physical locations. Settings between sites are isolated. Only one UniFi gateway (UXG or USG) can be adopted per site. To create a new site, click the Current Site drop-down and then "+ Add new site". You can also import a site.

Creating and managing users

There are a few different ways to create the Admin or Super Admin accounts. You can invite by email, create the account and share the password, or invite an existing admin to a site. I will explain each below.

Send an invitation via email

  • Will send an invitation email to the user for them to configure their account, but only if Settings > Controller > Mail Server is configured and working

  • Make sure that you have configured Settings > Controller > Controller Hostname/IP in order for the link in the email to go to the right address

  • You can only create the user as an Admin or Read Only Admin, but once they have accepted the invitation you can edit and promote the user to Super Admin if needed

  • Creating the user as an Admin or Read Only will only give permission to the current site

Manually set and share the password

  • With this option you can create the username, password, and permission level for the user without sending the invitation email

  • If you create an Admin or Read Only user, the user will only have access to the current site and any sites you invite them to with "Invite an existing admin"

Invite an existing admin

  • This option allows you to invite an existing admin to the current site

  • To invite an admin to multiple sites, repeat this for each site, using the sites drop-down to switch between the sites

  • Select Admin - search for an existing admin and select the username to invite the user to the current site. The admin will not show up in the search results if they already have permission on the current site

  • Set the role, site permissions, and global permissions

Deleting an Admin

You can delete an Admin by switching to the site the Admin was created under, and then clicking "Delete" next to the account under Settings > Admins. You will need to repeat this for each site the Admin account has permissions for.

Deleting a Super Admin

For Super Admins, you will notice there is no "Delete" button next to their account under Settings > Admins. To remove the account, you will first need to click "Edit" and change the account's role from Super Admin to Admin.

Once the account has been set as an Admin, you will need to delete that Admin account from each site that it has permissions for.

How to manage the sites

Naming your sites

Because UniFi doesn't have the concept of grouping sites together, you'll need to come up with an internal naming scheme for your sites. If you are an IT service provider, your site naming scheme might be "{Customer name} - {Customer Location}" for example.

The "Default" site

We recommend leaving the Default site in UniFi as-is, and not renaming it or using it for one of your sites. There is something "special" about the default site. For example, it is the only site that can't be deleted. We've run into weird issues in the past with sites that were built on the default site, so now we recommend to not use it for anything.

Deleting a site

To delete the current site, go to Settings > Site and click the "Delete Site" button.

HostiFi

HostiFi provides hosting for Ubiquiti hardware and software, with servers for UniFi and UISP as well as professional network services with HostiFi Pro.

If you run into any issues, send an email to support@hostifi.com or contact us via live chat.

Did this answer your question?