USER MANAGEMENT IN A MULTI-TENANT DATA MANAGEMENT SYSTEM

1 . A method for data management comprising:

receiving, at a data management system that is operable to provide protection for data sources associated with one or more tenants of the data management system, an indication to create a set of subtenants of a tenant, a first set of user profiles being associated with the tenant and a second set of user profiles being associated with a parent tenant of the tenant in accordance with metadata corresponding to the first set of user profiles and the second set of user profiles;

assigning, in response to receiving the indication, a first subset of the first set of user profiles to a first subtenant of the set of subtenants;

assigning, in response to receiving the indication, a second subset of the first set of user profiles to a second subtenant of the set of subtenants, wherein the first subset and the second subset exclude user profiles from the second set of user profiles that are non-overlapping with the first set of user profiles; and

updating, in response to assigning the first subset and the second subset, the metadata corresponding to the first set of user profiles and the second set of user profiles such that the first subset has access to the first subtenant for data management of a first data source associated with the first subtenant and the second subset has access to the second subtenant for data management of a second data source associated with the second subtenant.

2 . The method of claim 1 , further comprising:

displaying, at a user interface of the data management system, the first set of user profiles for selection for assignment to the first subtenant, wherein the second set of user profiles that are non-overlapping are excluded from display at the user interface and from selection for assignment.

3 . The method of claim 1 , wherein the first set of user profiles are associated with a single-sign-on directory configured for the tenant by an administrator of the parent tenant.

4 . The method of claim 1 , wherein the first set of user profiles comprises a subset of the second set of user profiles, the subset of the second set of user profiles being assigned to the tenant by an administrator of the parent tenant.

5 . The method of claim 1 , wherein assigning the first subset and the second subset comprises:

assigning a first user profile to both the first subtenant and the second subtenant.

6 . The method of claim 5 , further comprising:

receiving, at the first subtenant of the data management system, a login request for the first user profile;

determining, in response to the login request and based at least in part on metadata associated with the first user profile, that the first user profile is assigned to both the first subtenant and the second subtenant; and

enforcing, based at least in part on determining that the first user profile is assigned to both the first subtenant and the second subtenant, a login procedure associated with a higher security setting between a first login procedure associated with the first subtenant and a second login procedure associated with the second subtenant.

7 . The method of claim 6 , wherein the higher security setting is associated with a password length, a password character requirement, a two-factor authentication requirement, a password change periodicity requirement, or a combination thereof.

8 . The method of claim 5 , further comprising:

receiving, at a first user interface associated with the first subtenant and from the first user profile, a request to switch to the second subtenant;

determining, in response to receiving the request to switch and based at least in part on metadata associated with the first user profile, that the first user profile is assigned to both the first subtenant and the second subtenant; and

activating, based at least in part on determining that the first user profile is assigned to both the first subtenant and the second subtenant, a second user interface associated with the second subtenant.

9 . The method of claim 8 , wherein the second user interface is activated without requiring a new login procedure for the first user profile.

10 . The method of claim 5 , further comprising:

receiving, at a first user interface associated with the first subtenant and from the first user profile, a request to reset authentication parameters associated with the first user profile;

determining, in response to receiving the request to reset authentication parameters, that the first user profile is assigned to both the first subtenant and the second subtenant;

denying, at the first subtenant and based at least in part on determining that the first user profile is assigned to both the first subtenant and the second subtenant, the request to reset the authentication parameters; and

transmitting, via the first user interface, an indication that the first user profile is to request the authentication request via a user interface associated with the parent tenant.

11 . The method of claim 1 , further comprising:

receiving, at a user interface associated with the first subtenant, an indication of a first set of internet protocol (IP) addresses that are to be whitelisted for accessing the first subtenant, wherein the first set of IP addresses are different from a second set of IP addresses that are whitelisted for accessing the second subtenant.

12 . An apparatus, comprising:

a processor;

memory coupled with the processor; and

instructions stored in the memory and executable by the processor to cause the apparatus to:

receive, at a data management system that is operable to provide protection for data sources associated with one or more tenants of the data management system, an indication to create a set of subtenants of a tenant, a first set of user profiles being associated with the tenant and a second set of user profiles being associated with a parent tenant of the tenant in accordance with metadata corresponding to the first set of user profiles and the second set of user profiles;

assign, in response to receiving the indication, a first subset of the first set of user profiles to a first subtenant of the set of subtenants;

assign, in response to receiving the indication, a second subset of the first set of user profiles to a second subtenant of the set of subtenants, wherein the first subset and the second subset exclude user profiles from the second set of user profiles that are non-overlapping with the first set of user profiles; and

update, in response to assigning the first subset and the second subset, the metadata corresponding to the first set of user profiles and the second set of user profiles such that the first subset has access to the first subtenant for data management of a first data source associated with the first subtenant and the second subset has access to the second subtenant for data management of a second data source associated with the second subtenant.

13 . The apparatus of claim 12 , wherein the instructions are further executable by the processor to cause the apparatus to:

display, at a user interface of the data management system, the first set of user profiles for selection for assignment to the first subtenant, wherein the second set of user profiles that are non-overlapping are excluded from display at the user interface and from selection for assignment.

14 . The apparatus of claim 12 , wherein the first set of user profiles are associated with a single-sign-on directory configured for the tenant by an administrator of the parent tenant.

15 . The apparatus of claim 12 , wherein the first set of user profiles comprises a subset of the second set of user profiles, the subset of the second set of user profiles being assigned to the tenant by an administrator of the parent tenant.

16 . The apparatus of claim 12 , wherein the instructions to assign the first subset and the second subset are executable by the processor to cause the apparatus to:

assign a first user profile to both the first subtenant and the second subtenant.

17 . A non-transitory computer-readable medium storing code, the code comprising instructions executable by a processor to:

receive, at a data management system that is operable to provide protection for data sources associated with one or more tenants of the data management system, an indication to create a set of subtenants of a tenant, a first set of user profiles being associated with the tenant and a second set of user profiles being associated with a parent tenant of the tenant in accordance with metadata corresponding to the first set of user profiles and the second set of user profiles;

assign, in response to receiving the indication, a first subset of the first set of user profiles to a first subtenant of the set of subtenants;

assign, in response to receiving the indication, a second subset of the first set of user profiles to a second subtenant of the set of subtenants, wherein the first subset and the second subset exclude user profiles from the second set of user profiles that are non-overlapping with the first set of user profiles; and

update, in response to assigning the first subset and the second subset, the metadata corresponding to the first set of user profiles and the second set of user profiles such that the first subset has access to the first subtenant for data management of a first data source associated with the first subtenant and the second subset has access to the second subtenant for data management of a second data source associated with the second subtenant.

18 . The non-transitory computer-readable medium of claim 17 , wherein the instructions are further executable by the processor to:

display, at a user interface of the data management system, the first set of user profiles for selection for assignment to the first subtenant, wherein the second set of user profiles that are non-overlapping are excluded from display at the user interface and from selection for assignment.

19 . The non-transitory computer-readable medium of claim 17 , wherein the first set of user profiles are associated with a single-sign-on directory configured for the tenant by an administrator of the parent tenant.

20 . The non-transitory computer-readable medium of claim 17 , wherein the first set of user profiles comprises a subset of the second set of user profiles, the subset of the second set of user profiles being assigned to the tenant by an administrator of the parent tenant.