> For the complete documentation index, see [llms.txt](https://docs.coherent.global/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.coherent.global/tenant-administration/how-to-set-up-a-spark-tenant.md).

# How to: Set up a Spark tenant

{% hint style="info" %}
After an Excel file has been uploaded to Spark and the logic is converted to code, it is referred to as a Spark service. Folders are used to organize multiple Spark services together.
{% endhint %}

## Access management basics

* A Spark customer will have access to a [Keycloak](https://www.keycloak.org/documentation) realm, is referred to as a tenant.
* Check if your tenant has been set up as a [Private tenant](/identity-and-access-management/private-tenant.md). This is denoted in the [Navigation menu](/navigation/navigation-menu.md#user-menu). New tenants should be configured as a private tenant.
  * In a shared tenant, all users have access to all folders and services within a tenant.
  * In a private tenant, users have restricted access to folders and services depending on their group membership.
* User permissions are applied at the folder level.

## Plan user groups

### `tenant-admin`

At least one user should be nominated to be a `tenant-admin`. `tenant-admin` users can manage users, configure tenant settings, view usage data, manage active services.

In a private tenant, it is also recommended that all `tenant-admin` users add themselves to the `supervisor:pf` group.

### `supervisor:pf`

{% hint style="info" %}
Only applies to [Private tenant](/identity-and-access-management/private-tenant.md)s.
{% endhint %}

There may be a need for intermediate-level users who don't have tenant administrator privileges but can manage all folders on a tenant. In this case, supervisor users can be created. For example, an IT team is responsible for account administration, or a team leader needs to be able to manage different folders in Spark.

In a private tenant, `supervisor:pf` users have full access to all services within Spark and the ability to define the permissions for each folder.

### Custom user groups `user:<name>`

{% hint style="info" %}
Only applies to [Private tenant](/identity-and-access-management/private-tenant.md)s.
{% endhint %}

In a private tenant, separate user groups can be created to separate access across different types of users. This reflects how within an organization, different teams and users have varying levels of access to knowledge within an organization. In Spark, access to folders can be managed depending on a user's group membership. Some examples could include:

* Finance team and marketing team manage calculation and logic separately: `user:finance` cannot access the `Marketing` folder.
* American and Canadian branches of an organization: `user:canada` and `user:us` work on the `Canada` and `US` folders separately.
* A research team working on a sensitive project: `user:top_secret` only has access to `Project X`.
* An audit team that needs only `read` permissions: `user:audit`&#x20;

#### Standard user group `user:pf`

* For any tenant type, users must be a member of `user:pf` to sign in to the Spark user interface.

## Set up user accounts

Compare [Benefits of identity provider versus local accounts](/identity-and-access-management/single-sign-on/benefits-of-identity-provider-versus-local-accounts.md).

{% tabs %}
{% tab title="Identity provider" %}

1. Integrating your identity provider (IdP) with Single sign-on is strongly recommended for better security and alignment to organization.
2. Review [IAM fundamentals](/identity-and-access-management/iam-fundamentals.md) and [IdP recommendations](/identity-and-access-management/single-sign-on/idp-recommendations.md).
3. Set up the integration between Spark's identity provider (IdP) ([Keycloak](https://www.keycloak.org/documentation)) with yours. Use the [Single sign-on](/identity-and-access-management/single-sign-on.md) guides for Entra and Okta.
4. Add any custom user groups within Keycloak.
5. Provision the user accounts through your IdP.
6. Keep group and role assignments in your organization’s IdP and use Keycloak IdP mappers to map them to Keycloak groups.
7. Tell your teams about [Coherent Spark](https://docs.coherent.global/) and [Coherent Academy!](https://coherentacademy.coherent.global/)!
   {% endtab %}

{% tab title="Local accounts" %}

1. Local accounts are accounts that can be created and managed through the Spark interface. They are not recommended for long term use.
2. Sign in to Spark.
3. Set up any custom [User groups](/identity-and-access-management/user-groups.md).
4. Add [Local accounts](/identity-and-access-management/local-accounts.md) users and assign them to the appropriate user groups. Remember `user:pf` membership is required to access Spark!
5. Users will receive an email invitation.
6. Tell your teams about [Coherent Spark](https://docs.coherent.global/) and [Coherent Academy](https://coherentacademy.coherent.global/)!
   {% endtab %}
   {% endtabs %}

## Add folders with specific permissions

{% hint style="info" %}
Only applies to [Private tenant](/identity-and-access-management/private-tenant.md)s.
{% endhint %}

1. Make sure you have created any additional new user groups in the previous step.
2. From the [Home](/navigation/home.md) screen, select **New folder** to make a new folder and follow the steps. For guidance see [Home](/navigation/home.md#add-a-new-folder).
3. Return to the [Home](/navigation/home.md) screen.
4. Select the ellipsis menu of the folder and select **Set permissions**.
5. From the dropdown select a user or user group. You can also type characters to filter the dropdown list.
6. After adding the user or user group, the default permissions granted are `read` only.
7. Select the boxes for `create` , `execute`, `update`, `delete` as required. Reference [Private tenant](/identity-and-access-management/private-tenant.md#spark-entity-permission-types). Once selected, the permissions are automatically applied. For example:
   * A "Finance projections" folder with full permissions assigned to `user:finance` users.
   * An audit team under `user:audit` can be assigned `read` permissions to all folders.

## Set up the machine-to-machine integration

Compare [Benefits of client credentials versus API keys](/identity-and-access-management/client-credentials/benefits-of-client-credentials-versus-api-keys.md).

{% tabs %}
{% tab title="Client credentials" %}
Client credentials have the properties of a user account but are used by machines and applications.

See [Client credentials](/identity-and-access-management/client-credentials.md) for more information.
{% endtab %}

{% tab title="API keys" %}
API keys can be used to integrate with the [Execute API](/spark-apis/execute-api.md) and other [Spark APIs](/spark-apis/getting-started.md) with [Permissions - Features permissions](/spark-apis/authorization-api-keys/permissions-features-permissions.md).

See [Authorization - API keys](/spark-apis/authorization-api-keys.md) for more information.
{% endtab %}
{% endtabs %}

## Adjust tenant configurations

`tenant-admin` users can modify behaviors on the tenant. Recommended settings to review include:

* **Include cover sheet in upload service for new service uploads:** set to `false`.
* **Enable notifications for API key expiration**: set to `true` if you have created any API keys that are used for integration purposes.
* **IP allowlisting**: allow access to your Spark tenant for only a specific range of IP addresses.
* **Tags**: Tags categorize the service versions uploaded to Spark. Tags are set for new service versions or edited from the [Service Documentation](/navigation/service-documentation.md#version-details).
* **Webhook configuration**: See [How to: Automate workflows with webhooks](/integrations/how-to-automate-workflows-with-webhooks.md).

For the full list of configurations, see [Tenant configuration](/tenant-administration/tenant-configuration.md).