From 37a0972595ddc6cbf014d1d05fd68f4447405f68 Mon Sep 17 00:00:00 2001 From: maliming Date: Wed, 22 Apr 2026 18:15:42 +0800 Subject: [PATCH] Document host-only vs tenant-admin operations in shared mode --- .../modules/account/shared-user-accounts.md | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/docs/en/modules/account/shared-user-accounts.md b/docs/en/modules/account/shared-user-accounts.md index 4df18e2fdf..6f028238c6 100644 --- a/docs/en/modules/account/shared-user-accounts.md +++ b/docs/en/modules/account/shared-user-accounts.md @@ -142,6 +142,30 @@ Configure(options => ![new-user--join-strategy-inform](../../images/new-user-join-strategy-inform.png) +## Tenant Admin vs Host Admin Operations + +When the Shared strategy is enabled, a user is a **global resource** across host and all tenants. Their identity, activation state, lockout, password policy and two-factor settings live at the host level. Therefore some user management operations are restricted to host administrators and are not available to tenant administrators. + +### Host-only operations + +The following operations can only be performed by a host administrator when Shared is enabled. Both the Identity Pro UI (MVC + Blazor) and the `IdentityUserAppService` enforce this — a direct API call from a tenant context will be rejected with a `UserFriendlyException`: + +- Delete a user +- Activate / deactivate a user (`IsActive`) +- Lock / unlock a user +- Enable or disable two-factor authentication +- Change `LockoutEnabled` or `ShouldChangePasswordOnNextLogin` + +### What tenant admins can do + +- Invite users to the tenant (see the Invitation flow above) +- Manage role and organization-unit assignments within the tenant +- View audit / security logs scoped to the tenant + +### What a user can do for themselves + +Users can leave a tenant from their own account menu (`Switch Tenant` → `Leave`). Leaving marks the tenant membership as `Leaved = true` and preserves the user's host identity, so they can be re-invited later with the same `UserId`. + ## Migration Guide If you plan to migrate an existing multi-tenant application from an isolated strategy to Shared User Accounts, keep the following in mind: