diff --git a/src/Volo.Abp.MultiTenancy.Application.Contracts/Volo/Abp/MultiTenancy/AbpMultiTenancyApplicationContractsModule.cs b/src/Volo.Abp.MultiTenancy.Application.Contracts/Volo/Abp/MultiTenancy/AbpMultiTenancyApplicationContractsModule.cs
index ad718c7eaf..fb22df7499 100644
--- a/src/Volo.Abp.MultiTenancy.Application.Contracts/Volo/Abp/MultiTenancy/AbpMultiTenancyApplicationContractsModule.cs
+++ b/src/Volo.Abp.MultiTenancy.Application.Contracts/Volo/Abp/MultiTenancy/AbpMultiTenancyApplicationContractsModule.cs
@@ -1,4 +1,5 @@
 using Microsoft.Extensions.DependencyInjection;
+using Volo.Abp.Authorization.Permissions;
 using Volo.Abp.Modularity;
 
 namespace Volo.Abp.MultiTenancy
@@ -9,6 +10,11 @@ namespace Volo.Abp.MultiTenancy
     {
         public override void ConfigureServices(IServiceCollection services)
         {
+            services.Configure<PermissionOptions>(options =>
+            {
+                options.DefinitionProviders.Add<AbpTenantManagementPermissionDefinitionProvider>();
+            });
+
             services.AddAssemblyOf<AbpMultiTenancyApplicationContractsModule>();
         }
     }
diff --git a/src/Volo.Abp.MultiTenancy.Application.Contracts/Volo/Abp/MultiTenancy/AbpTenantManagementPermissionDefinitionProvider.cs b/src/Volo.Abp.MultiTenancy.Application.Contracts/Volo/Abp/MultiTenancy/AbpTenantManagementPermissionDefinitionProvider.cs
new file mode 100644
index 0000000000..350eef8b0e
--- /dev/null
+++ b/src/Volo.Abp.MultiTenancy.Application.Contracts/Volo/Abp/MultiTenancy/AbpTenantManagementPermissionDefinitionProvider.cs
@@ -0,0 +1,17 @@
+using Volo.Abp.Authorization.Permissions;
+
+namespace Volo.Abp.MultiTenancy
+{
+    public class AbpTenantManagementPermissionDefinitionProvider : PermissionDefinitionProvider
+    {
+        public override void Define(IPermissionDefinitionContext context)
+        {
+            var identityGroup = context.AddGroup(TenantManagementPermissions.GroupName);
+
+            var rolesPermission = identityGroup.AddPermission(TenantManagementPermissions.Tenants.Default);
+            rolesPermission.AddChild(TenantManagementPermissions.Tenants.Create);
+            rolesPermission.AddChild(TenantManagementPermissions.Tenants.Update);
+            rolesPermission.AddChild(TenantManagementPermissions.Tenants.Delete);
+        }
+    }
+}
diff --git a/src/Volo.Abp.MultiTenancy.Application.Contracts/Volo/Abp/MultiTenancy/TenantManagementPermissions.cs b/src/Volo.Abp.MultiTenancy.Application.Contracts/Volo/Abp/MultiTenancy/TenantManagementPermissions.cs
new file mode 100644
index 0000000000..273e96b3f9
--- /dev/null
+++ b/src/Volo.Abp.MultiTenancy.Application.Contracts/Volo/Abp/MultiTenancy/TenantManagementPermissions.cs
@@ -0,0 +1,15 @@
+namespace Volo.Abp.MultiTenancy
+{
+    public static class TenantManagementPermissions
+    {
+        public const string GroupName = "AbpTenantManagement";
+
+        public static class Tenants
+        {
+            public const string Default = GroupName + ".Tenants";
+            public const string Create = Default + ".Create";
+            public const string Update = Default + ".Update";
+            public const string Delete = Default + ".Delete";
+        }
+    }
+}
\ No newline at end of file
diff --git a/src/Volo.Abp.MultiTenancy.Application/Volo/Abp/MultiTenancy/TenantAppService.cs b/src/Volo.Abp.MultiTenancy.Application/Volo/Abp/MultiTenancy/TenantAppService.cs
index cf765800a4..3ebfe164c8 100644
--- a/src/Volo.Abp.MultiTenancy.Application/Volo/Abp/MultiTenancy/TenantAppService.cs
+++ b/src/Volo.Abp.MultiTenancy.Application/Volo/Abp/MultiTenancy/TenantAppService.cs
@@ -1,10 +1,12 @@
 using System;
 using System.Collections.Generic;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Authorization;
 using Volo.Abp.Application.Dtos;
 
 namespace Volo.Abp.MultiTenancy
 {
+    [Authorize(TenantManagementPermissions.Tenants.Default)]
     public class TenantAppService : MultiTenancyAppServiceBase, ITenantAppService
     {
         private readonly ITenantRepository _tenantRepository;
@@ -34,6 +36,7 @@ namespace Volo.Abp.MultiTenancy
             );
         }
 
+        [Authorize(TenantManagementPermissions.Tenants.Create)]
         public async Task<TenantDto> CreateAsync(TenantCreateDto input)
         {
             var tenant = await _tenantManager.CreateAsync(input.Name);
@@ -41,6 +44,7 @@ namespace Volo.Abp.MultiTenancy
             return ObjectMapper.Map<Tenant, TenantDto>(tenant);
         }
 
+        [Authorize(TenantManagementPermissions.Tenants.Update)]
         public async Task<TenantDto> UpdateAsync(Guid id, TenantUpdateDto input)
         {
             var tenant = await _tenantRepository.GetAsync(id);
@@ -49,6 +53,7 @@ namespace Volo.Abp.MultiTenancy
             return ObjectMapper.Map<Tenant, TenantDto>(tenant);
         }
 
+        [Authorize(TenantManagementPermissions.Tenants.Delete)]
         public async Task DeleteAsync(Guid id)
         {
             var tenant = await _tenantRepository.FindAsync(id);