> For the complete documentation index, see [llms.txt](https://docs.coherent.global/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.coherent.global/tenant-administration.md).

# Tenant administration

{% hint style="info" %}
The user administration may differ if using [Single Sign-On](/identity-and-access-management/single-sign-on.md).
{% endhint %}

This guide provides guidance and recommendations on how to set up Spark user groups, users, and API keys.

* This content mainly relates to the pages [Manage users](/tenant-administration/manage-users.md) and [Authorization - API keys](/spark-apis/authorization-api-keys.md).
* Please read our [Get started in 5 minutes](/getting-started-in-5-minutes.md) page before using this guide.

## Relevant Spark terminology

* First check if your tenant has been set up as a [Private tenant](/tenant-administration/private-tenant.md). This is denoted in the [Navigation menu](/navigation/navigation-menu.md#user-menu).
  * In a Shared tenant, all users have access to all folders and services within a tenant.
  * In a [Private tenant](/tenant-administration/private-tenant.md), users have restricted access to folders and services:
* After an Excel file has been uploaded to Spark and the logic is converted to code, it is referred to as a service.
* Folders are used to organize multiple services together.
* User permissions can be applied to the folder level.

## Add customized user groups

{% hint style="info" %}
This is only relevant if your tenant has been set up as a [Private tenant](/tenant-administration/private-tenant.md).
{% endhint %}

An organization may contain different teams who should have separate access to services in Spark. Some examples could include:

* Finance team and marketing team manage calculation and logic.
* American and Canadian branches of an organization.
* A research team working on a sensitive project.
* An audit team that needs only `read` permissions.

If your tenant has been set up as a [Private tenant](/tenant-administration/private-tenant.md), separate user groups can be created to separate access different groups of users.

1. Follow the steps in [Manage users](/tenant-administration/manage-users.md#add-user-groups) to create the relevant user groups representative of the organization. Custom user groups must begin with `user:`. Examples could include: `user:audit`, `user:canada`, `user:finance`.

## Add tenant administrators

You will likely need to have multiple tenant administrators who can also manage [Active services](/tenant-administration/active-services.md), [Authorization - API keys](/spark-apis/authorization-api-keys.md), [Manage users](/tenant-administration/manage-users.md#user-groups), and[Manage users](/tenant-administration/manage-users.md#users).

1. Follow the steps in [Manage users](/tenant-administration/manage-users.md#add-users) and create an account for the other tenant administrators.
   * These accounts should be created with membership in `user:pf` and `tenant-admin` user groups.
   * If this is a [Private tenant](/tenant-administration/private-tenant.md), it is recommended that all `tenant-admin`s are also added to the `supervisor:pf` user group. This enables `tenant-admin`s to see all the folders within your tenant. This is not enabled by default.

## Add supervisor users

{% hint style="info" %}
This is only relevant if your tenant has been set up as a [Private tenant](/tenant-administration/private-tenant.md).
{% endhint %}

There may be a need for intermediate-level users who don't have tenant administrator privileges but can manage all folders on a tenant. In this case, supervisor users can be created. This could for example be where an IT team is responsible for account administration and a team leader needs to be able to manage different folders in Spark.

1. Follow the steps in [Manage users](/tenant-administration/manage-users.md#add-users) and create an account for supervisors.
   * These accounts should be created with membership in `user:pf` and `supervisor:pf` user groups.

## Add additional users

1. Follow the steps in [Manage users](/tenant-administration/manage-users.md#add-users) and create an accounts for Spark users.
   * All users must be members of `user:pf` to login to Spark.
   * If this is a [Private tenant](/tenant-administration/private-tenant.md), users can also be assigned to the user groups added earlier.
2. Tell teams about this [user guide](https://docs.coherent.global/) and [Coherent Academy](https://coherentacademy.coherent.global/)!

## Add folders with specific permissions

{% hint style="info" %}
This is only relevant if your tenant has been set up as a [Private tenant](/tenant-administration/private-tenant.md).
{% endhint %}

1. If user groups have been created in the previous step, it may help to initialize working folders for the organization with different permissions.
2. Follow the steps in [Home](/navigation/home.md#add-a-new-folder) to create additional folders.
3. Follow the steps in [Private tenant](/tenant-administration/private-tenant.md#set-permissions-on-folders-via-api) to add the customized team groups and the appropriate permissions.
   * For example, this could be a *Finance projections* folder with permissions assigned to `user:finance` users.
   * Only add `user:pf` to a folder in a [Private tenant](/tenant-administration/private-tenant.md) if all users should be able to access this folder.

## Add API keys for calling Spark APIs

API Keys can be used to integrate with the [Execute API](/spark-apis/execute-api.md) and other management APIs in [Permissions - Features permissions](/spark-apis/authorization-api-keys/permissions-features-permissions.md).

* In Spark, you must create an API key group first.
* [Authorization - API keys](/spark-apis/authorization-api-keys.md#api-key-groups) can contain multiple [Authorization - API keys](/spark-apis/authorization-api-keys.md#api-key-instances).
  * A key instance would correspond to an API key that is used for authentication.
  * Multiple key instances are useful for managing key rotation, where the to-be-deactivated, expiring key and the next API key have an overlap for continuity.
* An API key group represents the combined access rights of multiple user groups.

Follow the steps in [Authorization - API keys](/spark-apis/authorization-api-keys.md#add-api-key-groups) to create the first API key group.

1. If this is a Shared tenant, we recommend making the initial API key one that can access all Spark services. Do so by assigning the user group `user:pf` to the API key group.
2. If this is a Private tenant, then assign the appropriate user groups created earlier.