Create a Tenant Admin
This page is for Platform administrators. It explains how to create a tenant administrator for a tenant that does not yet have one, directly from the normal Platform context.
Where to Start
Open Platform → Tenant Admins, then choose Create Tenant Admin. This is the direct create-and-link flow. It works from the normal Platform context and does not require entering Tenant Inspector or a selected-tenant context.
Choosing an Eligible Tenant
The page shows a single-select Tenant dropdown that lists only tenants that do not yet have an active tenant administrator. Tenants that already have an active admin, deleted tenants, and otherwise ineligible tenants are excluded.
When no tenant is eligible, the page shows an empty-state message that explains why and links back to the tenant list.
Fields
| Field | Required | What it does |
|---|---|---|
| Tenant | Yes | Single-select dropdown of eligible tenants (those with no active admin). |
| Full name | Yes | The tenant admin's full name. |
| Yes | The tenant admin's email address. Used to find an existing eligible account or to create a new one. | |
| Phone | No | The tenant admin's phone number. |
| Temporary password | Yes | An initial password. It is never emailed, never stored in plain form, and never logged. |
| Confirm temporary password | Yes | Re-enter the temporary password to confirm it. |
| Access channel | No | An optional access channel for the new admin. |
What Happens on Submit
- The server re-validates the selected tenant: it confirms the tenant exists, is active, and still has no admin. A stale or forged selection fails safely.
- The single-tenant-admin rule is re-checked inside the write transaction, so two near-simultaneous requests cannot both create an admin for the same tenant.
- The account is resolved (existing-account reuse or new account — see below) and linked as the tenant admin.
Existing-Account Reuse
- If the email belongs to an eligible existing Website-only account, that same Identity is reused and linked as the tenant admin. No duplicate account is created, and the account's credentials, profile, and email-confirmation state are preserved.
- Otherwise, a new account is created.
In both cases, the new tenant admin's first sign-in requires a password change and OTP verification.
Required Permission
To use this flow you need the platform super-admin policy plus the "manage tenant users" system permission.
What Did Not Change
The security filter that guards platform pages from a selected-tenant context was not changed. Its behavior is preserved. The workflow was fixed only by:
- Adding the eligible-tenant dropdown, and
- Removing the redundant selected-tenant-context requirement from this specific creation flow.
Every authority check and the single-tenant-admin invariant are preserved.