{{ $t('productDocDetail.updateTime') }}: 2025-12-18

Function Description:

Sangfor SCP platform supports the role of the MSP administrator. The platform administrator establishes the role of the MSP administrator and issues resource pool quotas to the operation administrator, allowing the MSP administrator to assign them himself. For example, in a hosting cloud/operator scenario, the company headquarters has purchased a large-scale resource pool, and resources need to be allocated to each branch. The branch needs to create tenants for each department or group.

Precautions:

1. The system administrator needs to manually switch to the operation mode and enable the MSP operation management system, but it cannot be rolled back after the switch. Please evaluate the usage scenarios and operate with caution.
2. After the platform administrator converts the platform to the MSP operation mode, when creating a new tenant, must designate an MSP administrator for the tenant. It would not affect the existing tenants. It would not affect the existing tenants.
3. After the MSP administrator is assigned to a tenant, the quota used by the tenant is not allowed to exceed the quota of the MSP administrator to which he belongs.
4. The MSP administrator's name, email address, and phone number cannot be reused by other users.
5. MSP administrator login address: https://{SCP-IP}/msp-login.

Prerequisite

None.

Steps:

Step 1.Enter the System > Licensing > Platform License and click the Update button.

Step 2.Click Switch to MSP Mode in the pop-up window. Enter the administrator password.

Step 3.The conversion to operation mode is completed. You can see the MSP Administrator page in the User and Access Management interface and the MSP Administrator Quota page in the Quota Management interface. Enter the MSP Administrator interface and click the New button to create a new operation administrator.

Name	Name	Can contain only letters, digits, Chinese characters, spaces and the following special characters: ()（）【】@._-+
Username	Tenant Name: The account name used by users to log in to the MSP account.	Can contain only letters, digits, and underscores (_).
Email Address	Enter a valid email address for login and retrieving password if necessary.	Must be a valid email address.
Mobile Number	You can log in to the MSP account via SMS verification or receive platform alert notifications through SMS.	Must be a valid mobile phone number.
Password	Set the password for this MSP account, which is used to log in to the MSP platform. You can either configure the password manually or select the platform to generate it automatically. Additionally, you can check the box labeled "Require password change at first login" to force the MSP to reset their password after logging into the MSP account for the first time.	1. Must contain 8-64 characters. 2. Must contain 4 of the following: uppercase letters, lowercase letters, digits and special characters. 3. Can contain the following special characters (~`@#%&<>"',;_-^$.*+?=!:|{}()[]/\) 4. Cannot contain username. 5. Can contain up to 1 consecutive identical characters. 6. Cannot contain any of the following words: sangfor, sinfor, dlanrecover (case-insensitive). 7. Cannot contain any individual product names (case-insensitive), such as acmp and scp, but strings such as acmpt or xscp are allowed.

Step 4.Click Next to allocate resource pools. It supports the allocation of HCI Resource Pools, Dedicated Server Groups, and VMware Resource Pools for MSP administrators.

Shared Resource Pools	Resource Pools from HCI, you can select all HCI resource pools or specific ones.
VMware Resource Pools	Resource Pools from VMware, you can select all VMware resource pools or specific ones.

Step 5.Please create a network for the selected resource pool or deploy a network for the tenant after the tenant is created.

Network Type:

VPC：Used for the scenarios where an isolated network environment is required for high security. A router will be created by default to connect to the virtual switch.
VPCs block inbound traffic from the Internet by default. To allow the traffic, please configure ACL on the router in the corresponding VPC on the Topology page.

Name	1. Must contain 1-60 characters. 2. Can contain letters, digits, and Chinese characters. 3. Can contain spaces and any of the following special characters: . _ - 4. Cannot begin with a dot (.)
VPC Gateway	Select the physical ports that have been created in SCP.
Shared Service - Storage Service Gateway	Configure shared service exits for storage types (e.g., connect to the iSCSI service of HCI) and enable storage shared services for tenants to use
Shared Service - Non-storage Service Gateway	Configure shared service exits for non-storage types (e.g., connect to SKE) and enable non-storage shared services for tenants to use.

Used for the scenarios where a tenant communicates directly with other tenants or physical network. A switch will be created by default to connect to the virtual switch.

Gateway Name	1. Must contain 1-60 characters. 2. Can contain letters, digits, and Chinese characters. 3. Can contain spaces and any of the following special characters: . _ - 4. Cannot begin with a dot (.)
VPC Gateway	Select the target device that have been created in SCP.

Step 6.Click Confirm to complete the operation administrator creation.

Step 7.After the MSP administrator is created, enter the MSP Administrator Quota interface to set the quota for the operation administrator.

On this page, you can click Export Quota Report to export the quota report. You can also click Set All to 0 or Set All to Default to set all quotas to 0 or Default respectively, which allows you to reset all quotas from scratch.

Step 8.Go to the User and Access Management > User > Tenant interface, find the tenant for which an operation administrator is not specified, and click Edit to specify an MSP administrator.

There are three roles in SCP's multi-tenant management model: platform administrator (admin), tenant, and tenant user account. For example, a company (platform) has multiple departments (tenants), and each department has several employees (tenant user). Several tenants can be allocated on the Sangfor cloud computing platform, corresponding to each department. Several tenant sub-accounts can be allocated under the tenants, corresponding to the department's employees. The company needs to designate a platform administrator (admin), and each department needs to designate a tenant.