Tenants
This page describes the tenant model and authentication methods used in Platon's observability platform.
What is a tenant?
A tenant is an isolated space for your team's observability data, so you can only see data belonging to your tenant(s). Each tenant has:
- Separate storage for logs, metrics, and traces
- Access controlled by an Entra ID group and/or basic authentication
- Dedicated Grafana organization and data sources
Requesting a tenant
Contact the Platon team on #platon-observability (Slack) with:
- A descriptive tenant name (e.g., "my-team" or "my-product")
- The Microsoft Entra ID group for access control
We will:
- Add the tenant to the auth-proxy (for Loki, Mimir, Tempo)
- Set up a Grafana organization
- Configure data sources
- Configure Grafana to use the Entra ID group
If the Grafana data source for a new tenant returns 403, the access grant for the tenant is still missing. Ask in #platon-observability (Slack) and we will add it.
Authentication methods
How you authenticate depends on where your application runs. See the getting started guide for your setup:
- PaaS Logging - No authentication needed, because Vector handles it
- PaaS Full Observability - No tenant header needed, because Alloy assigns the tenant once your namespace is onboarded
- Puppet-managed VMs - Credentials managed by Puppet via Vault
- External Services - Full authentication required (Basic Auth + tenant header)
Data retention
The default retention period for all observability data is 180 days. This can be adjusted per tenant if your team has different requirements. Contact the Platon team on #platon-observability (Slack) to request a change.
Multiple tenants
A team can have multiple tenants if needed, for example to separate production and staging data or to isolate different products. Contact the Platon team to set up additional tenants.