A provider organization is the top-level parent organization in Versa’s multitenant architecture. Provider users can be granted access to system-wide resources and, depending on role, administer the entire platform – infrastructure, licensing, and every tenant beneath it – as the root of the hierarchy that Director, Concerto, and Titan Portal all build on.
Key takeaways
- Provider organizations sit at the root of Versa’s tenancy hierarchy.
- Provider users can administer infrastructure and every tenant beneath them.
- MSPs, resellers, and enterprises all structure themselves as providers.
- Log exports and appliance health resolve to provider-tenant context.
- A tenant can itself act as provider organization for its own subtenants.
On this page: Why it mattersHow it worksKinds of provider organizationsProvider organizations & VersaFAQ
Why are provider organizations important?
Every tenant hierarchy in Versa needs a root, and the provider organization is it. Whether the deployment is an enterprise carving out business units or an MSP reselling SD-WAN and SASE to hundreds of customers, something has to own the shared infrastructure and hold authority to create and administer everything beneath it.
This matters operationally, not just structurally. Provider-level administrators alone can create certain classes of gateway, upload the certificates tenants inherit, and configure the logging profiles that decide how tenant telemetry is exported. In Titan Portal, an MSP without a provider organization cannot order private SASE gateways – the role is a prerequisite. It also makes multitenancy auditable: visibility and change funnel through one accountable root, not scattered tenants with no owner.
What is a provider organization?
In Versa Director and Controller, every configured object – appliances, templates, policies, users – belongs to an organization, and organizations nest. A provider organization sits at the top: not scoped beneath any other organization, with everything else in the hierarchy, whether one customer tenant or a chain of resellers, beneath it. Provider users can be granted system-wide resource access and, depending on role, administer the entire system across all tenants.
The same shape recurs across Versa’s portals. In Analytics, selecting a provider organization reveals the tenant organizations nested under it; in Titan Portal, the Organizations dashboard lists provider and reseller provider organizations alongside the customer organizations each manages. The provider organization is also the default context for infrastructure that isn’t tenant-specific – appliance health on a multitenant VOS device reports in provider organization (appliance owner) context, not any tenant’s.
Kinds of provider organizations
Not every provider organization looks the same, though the structural role is identical. An MSP provider organization is a managed service provider’s root: it owns the infrastructure it resells, orders gateway hardware and licenses through Titan Portal, and creates the customer organizations it services. A reseller provider organization sits one layer further out – a reseller created under an MSP, itself capable of provider organization access.
The role isn’t always a dedicated top-level entity. When a tenant is configured for dedicated SASE gateways, its SSE gateways are created on Versa Director with that MSP tenant standing in as provider organization for its own subtenants. In single-company deployments with no resale layer, the enterprise’s own root organization is simply the provider organization for its business-unit tenants.
Provider organizations & Versa
The provider organization shows up wherever Versa’s platform needs one accountable root. It’s the top node of the organization tree that Concerto’s tenant-creation workflows and the multitenancy configuration model build on. In Titan Portal, provider organizations are how MSPs and resellers structure their business: the Configure, Monitor, Troubleshoot, and Inventory dashboards scope to it by default, and only a user with the Operator role can add a private, multitenant, or multitenant RAC/RAS gateway for one – see the Titan order-management guide.
Logging and licensing resolve through the provider layer too. A default Log Export Functionality (LEF) profile at the provider organization lets a multitenant VOS device export logs, tagged with provider–tenant context, and the provider organization uploads the certificates (VSA, TLS decryption) copied down to every tenant it creates.
Frequently asked questions
Is a provider organization the same as a tenant?
No. Both are organizations in Versa’s model, but a tenant is scoped beneath a provider and manages only its own resources, while the provider organization sits at the root, owns the shared infrastructure, and can be granted system-wide access to administer every tenant beneath it.
Who can create a provider organization?
Provider organizations are typically established when Versa infrastructure is first provisioned for an MSP, reseller, or enterprise. Within an existing provider, only users with sufficient privilege – such as the Operator role – can create resellers or add gateways scoped to that provider.
Can a tenant act as a provider organization for its own subtenants?
Yes. When a tenant is configured for dedicated SASE gateways, its SSE gateways are created on Versa Director with that tenant standing in as provider organization for the subtenants beneath it – the same structural role, occupied one level down the hierarchy.
What can a provider organization see that a tenant cannot?
A provider organization’s administrators can access system-wide resources across every tenant beneath them – logs, appliance health, licensing, configuration – depending on their role. A tenant administrator’s visibility stops at its own tenant; it cannot see neighboring tenants or shared infrastructure.
Does every Versa deployment need a provider organization?
Yes. Every organization in Versa Director and Controller nests under something, and the provider organization is the node with nothing above it. Even a single-company deployment with no resale layer has one – it’s simply the enterprise’s own root organization.
Related terms
If you’re reading about provider organizations, these are worth looking at next.
| Tenant | Organization | Operator |
|---|---|---|
| The customer-scoped unit beneath a provider, with its own admins, policies, and services on shared infrastructure. | The Director and Controller construct representing a tenant or provider; organizations nest, with providers at the root. | The Titan Portal role that is the only one able to add certain gateways for a provider organization. |