Getting Started as a Tenancy Manager

This guide is for users who have been assigned the Tenancy Manager role in DekkoSecure. It walks you through the key setup tasks, explains what you are responsible for, and points you to the detailed guides you will need along the way.

The Tenancy Manager role is assigned by DekkoSecure staff. If you believe you should have this role but do not see the Tenancy Manager controls in your account, please submit a support request.

A Tenancy is the top-level organisational level in DekkoCORE. It is the central location where you manage users, enforce policies, review activity, and govern the Hubs that belong to your Tenancy. An organisation can have one or multiple Tenancies depending on its plan.

As a Tenancy Manager, you are the administrator of this environment. However, you do not automatically have access to the files and messages that users store in DekkoCORE. The platform uses end-to-end encryption and explicit sharing, which means content is only visible to the users who own it or have been explicitly granted access. Your role is to manage the organisational structure, not to access user content.

As a Tenancy Manager, you have access to the Tenancy Manager dashboard. From this dashboard you can:

For a full breakdown of what each role can and cannot do, see Tenancy and Hub Roles.

The tasks below are listed in the order most Tenancy Managers will need to complete them. You do not need to do everything at once, but working through them in sequence will ensure your environment is properly configured before users start collaborating.

Log in to the DekkoCORE instance for your region:

Once logged in, select Tenancy Manager under your profile in the top right corner:

As a part of the onboarding DekkoSecure will always go through the full set of Tenancy policies and map them with you. Before you add users or create Hubs, we recommend that you review the Tenancy policies to check they are set in alignment with internal security governance policies. Tenancy policies control security and usage rules across your entire environment, including:

To configure policies, open the Tenancy Manager dashboard and select the Policies tab.

For a detailed explanation of each policy setting, see Tenancy Policies article.

Hubs are the collaboration spaces where your users will store, share, and work on files. Think of a Hub as a secure project workspace, team folder, case folder or whatever makes sense in your context.

There’s several ways to create a Hub. When you first login:

You can also create a Hub within the Tenancy Manager:

You will automatically become the Hub Admin for any Hub you create. You can later assign additional Hub Managers from within the Hub. You can also remove yourself as Hub Admin after setting a second one.

For more detail on Hub configuration and management, see Create and Manage Hubs article.

Once you have created a Hub, you can add users to it. If users don’t already have an account when inviting them, they will get an invite email when being added to a Hub.

Add a users from the file management interface:

The user will receive an email notification that they have been added to the Hub.

From the Tenancy Management interface (user must already be in the Tenancy):

For more detail on user management, see Adding Users to a Hub article.

When you add a user to a Hub, you assign them one of three roles. Choosing the right role determines what that user can see and do within the Hub.

Hub Admin: Full control over the Hub. Can add and remove users, change roles, view Hub Audit logs, manage Hub branding and configure Hub-level settings. Assign this role to team leads or project managers who need to manage the workspace.

Team Member: Can share files with, request signatures from, and message other Team Member and External Members with the Hub. Can see other Hub members and if given the permissions invite users to the Hub and create additional Hubs. This is the standard role for internal users who need full collaboration access.

External Member: Can share files with, request signatures from, and message Team Member users in the Hub. Can see Team Member users in the Hub contact list but not other External Members. Create additional Hubs (if allowed in Tenancy policies). Assign this role to external partners, contractors, or collaborators who need access to specific files but should not have full visibility of the Hub.

For a complete permissions breakdown, see Tenancy and Hub Roles article.

DekkoSecure recommends multi-factor authentication (MFA) for all users. You have two options for how authentication is handled in your organisation:

Standard authentication: Users register with an email address and password, then enable TOTP-based two-factor authentication (2FA) using an authenticator app. No configuration is required from you as the Tenancy Manager, users will be prompted to set up 2FA when they first log in.

Single Sign-On (SSO): If your organisation uses Microsoft Entra ID (formerly Azure AD), you can configure SSO so that users authenticate through your existing identity provider. This gives you centralised control over access, conditional access policies, and user provisioning.

To set up SSO, see Entra ID SSO Integration article.

DekkoCORE records all user and administrative activity in an immutable audit log. As a Tenancy Manager, you can review activity in two ways:

In-app audit logging: View activity logs directly in the Tenancy Manager dashboard. This gives you visibility into user actions, file operations, and administrative changes within your Tenancy.

SIEM integration (optional): If your organisation uses a Security Information and Event Management system, you can connect DekkoSecure to a Log Analytics Workspace and forward audit data to Microsoft Sentinel (or a compatible SIEM). This is recommended for organisations with centralised security monitoring requirements.

For setup instructions, see:

DekkoCORE uses end-to-end encryption and explicit sharing. As a Tenancy Manager, you can manage users, policies, and organisational structure, but you cannot view, open, or download files or messages unless the content owner explicitly shares them with you. This is by design and is a core security property of the platform.

When you delete a Hub, all files and messages stored in that Hub are permanently deleted, regardless of who uploaded them. User accounts and audit logs are not affected by Hub deletion, but the content itself cannot be recovered. Always confirm with Hub members before deleting a Hub.

Unlike Hub Manager, which can be assigned by other Hub Managers or by creating a new Hub, the Tenancy Manager role can only be assigned by DekkoSecure staff. If you need to add another Tenancy Manager to your organisation, please submit a support request.

When you change a tenancy policy, the change applies across all Hubs and users in your Tenancy immediately. There is no staging or preview mechanism. Test policy changes carefully, especially restrictions on sharing, uploading, archiving or security features as they may disrupt active workflows.

Depending on your organisation's network configuration, your IT team may need to whitelist DekkoSecure domains and related services. See Whitelisting and Browser Settings for the full list of domains and ports to allow.

Use this checklist to track your initial configuration. The order follows the steps described above.