# Opensearch Tenants vs Workspaces **URL:** \ **Category:** OpenSearch Dashboards\ **Created:** [May 6, 2026, 6:30am UTC](https://forum.opensearch.org/t/opensearch-tenants-vs-workspaces/28050 "2026-05-06T06:30:02Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Santhosh.Gollapudi](https://avatars.discourse-cdn.com/v4/letter/s/e79b87/32.png) [@Santhosh.Gollapudi](https://forum.opensearch.org/u/Santhosh.Gollapudi)\ **Post date:** [May 6, 2026, 6:30am UTC](https://forum.opensearch.org/t/opensearch-tenants-vs-workspaces/28050/1 "2026-05-06T06:30:02Z")
**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser): **Describe the issue** : OpenSearch - Tenants vs Workspaces - Which one is better ? **Configuration** : Is OpenSearch Tenants model will be deprecated ? We have the OpenSearch cluster setup for our business unit with 190+ applications. Which is best option if we need to onboard these applications into OpenSearch primarily for log monitoring ? These applications are managed by different teams or some teams are common for a few apps. We wanted to keep them isolated so these will be managed individually and App 1 cannot see or access App 2 logs or dashboards or alert rules etc. **Relevant Logs or Screenshots** : ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [May 7, 2026, 11:01am UTC](https://forum.opensearch.org/t/opensearch-tenants-vs-workspaces/28050/2 "2026-05-07T11:01:32Z")
@Santhosh.Gollapudi based on your use case, tenant and tenant permissions would be a good option. You can assign multiple roles to the same team, which will provide added to the relevant tenant. The users would need to change between tenants to see dashboard object (visualisations etc ) specific to that particular tenant. Hope this helps ---
**Author:** ![muraliv](https://avatars.discourse-cdn.com/v4/letter/m/f05b48/32.png) [@muraliv](https://forum.opensearch.org/u/muraliv)\ **Post date:** [May 7, 2026, 11:49am UTC](https://forum.opensearch.org/t/opensearch-tenants-vs-workspaces/28050/3 "2026-05-07T11:49:49Z")
Hi @Anthony - Looking at this closed github issue. ```auto http://github.com/opensearch-project/security/issues/1869 ``` Does it make more sense to implement workspaces instead of multi tenancy ? ---
**Author:** ![muraliv](https://avatars.discourse-cdn.com/v4/letter/m/f05b48/32.png) [@muraliv](https://forum.opensearch.org/u/muraliv)\ **Post date:** [May 8, 2026, 10:24am UTC](https://forum.opensearch.org/t/opensearch-tenants-vs-workspaces/28050/4 "2026-05-08T10:24:45Z")
Hi @Anthony What is the main reason for your recommendation to go with Tenants instead of workspaces? Is the isolation of saved objects like dashboards, visualizations, alerts, monitors, etc ? the ability for a user, belonging to workspace 1, to manage an alert or monitor that belongs to Workspace 2 ? ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [May 8, 2026, 1:46pm UTC](https://forum.opensearch.org/t/opensearch-tenants-vs-workspaces/28050/5 "2026-05-08T13:46:06Z")
@muraliv The main reason would be the maturity of the tenants vs workspaces. And the documentation available. Tenants are fully shipped and battle-tested. Workspaces were still being RFC’d and it seems the requirements are still being defined. For the use case outlined above it would seem to me that the tenants would be the simplest option forward. It’s also worth mentioning that both solutions are really about dashboard object isolation and not data isolation, which is achieved via roles and permissions. ---
**Author:** ![Santhosh.Gollapudi](https://avatars.discourse-cdn.com/v4/letter/s/e79b87/32.png) [@Santhosh.Gollapudi](https://forum.opensearch.org/u/Santhosh.Gollapudi)\ **Post date:** [May 8, 2026, 4:09pm UTC](https://forum.opensearch.org/t/opensearch-tenants-vs-workspaces/28050/6 "2026-05-08T16:09:07Z")
What is the future roadmap ? Workspaces will be directional or both tenants and workspaces will continue ? ---
**Author:** ![TimTom420](https://avatars.discourse-cdn.com/v4/letter/t/d2c977/32.png) [@TimTom420](https://forum.opensearch.org/u/TimTom420)\ **Post date:** [May 8, 2026, 11:59pm UTC](https://forum.opensearch.org/t/opensearch-tenants-vs-workspaces/28050/7 "2026-05-08T23:59:50Z")
To add to what @Anthony mentioned — for your specific use case of 190+ applications needing strict isolation for logs, dashboards, and alert rules, the Tenants model is the right choice right now for a few practical reasons: The Tenants model already has a solid permission system where you can scope index patterns and dashboards per tenant. With multi-tenant setups at this scale, you’ll want to map team roles to tenant access so teams can switch context via the tenant selector rather than needing separate clusters. As for the roadmap question, Workspaces are still being actively designed and the feature requirements are evolving. Given that your use case is well-served by Tenants today, I’d recommend building on that and watching the Workspaces RFC thread for when it stabilizes. The OpenSearch GitHub project has the Workspaces discussion if you want to track its progress or provide input. ---
**Author:** ![muraliv](https://avatars.discourse-cdn.com/v4/letter/m/f05b48/32.png) [@muraliv](https://forum.opensearch.org/u/muraliv)\ **Post date:** [May 11, 2026, 4:06pm UTC](https://forum.opensearch.org/t/opensearch-tenants-vs-workspaces/28050/8 "2026-05-11T16:06:55Z")
Are there some objects like alerts or monitors global ? Can a user from one tenant able to make changes to or delete an alert created by another user from another tenant? ---
**Author:** ![muraliv](https://avatars.discourse-cdn.com/v4/letter/m/f05b48/32.png) [@muraliv](https://forum.opensearch.org/u/muraliv)\ **Post date:** [May 11, 2026, 6:22pm UTC](https://forum.opensearch.org/t/opensearch-tenants-vs-workspaces/28050/9 "2026-05-11T18:22:44Z")
My teammate found this in the documentation that should have helped restricting a user to see or modify alerts from another tenant space. ```auto PUT _cluster/settings { "persistent": { "plugins.alerting.filter_by_backend_roles": "true" } } ``` I re-read the documentation and it says if a user has at least one common backend role, he/she should be able to see the alerts. With all of us being part of a domain, there is 100% chance of a ADOM group overlap. Is there an option to retrieve only the roles that are configured instead of getting all the ADOM groups ? Thanks ---
**Author:** ![muraliv](https://avatars.discourse-cdn.com/v4/letter/m/f05b48/32.png) [@muraliv](https://forum.opensearch.org/u/muraliv)\ **Post date:** [May 11, 2026, 6:55pm UTC](https://forum.opensearch.org/t/opensearch-tenants-vs-workspaces/28050/10 "2026-05-11T18:55:29Z")
> [@TimTom420](#): > > Workspaces RFC thread for when it stabilizes. The OpenSearch GitHub project has the Workspaces discussion if you want to track its progress or provide input. Can you please give us a link to this thread ? ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [May 12, 2026, 11:23am UTC](https://forum.opensearch.org/t/opensearch-tenants-vs-workspaces/28050/11 "2026-05-12T11:23:30Z")
I’ve tested this locally with 3.6, including ` "plugins.alerting.filter_by_backend_roles": "true"` and was not able to get monitor isolation working using either tenants or workspaces. Regarding the `filter_by_backend_roles`, it seems the user block stopped being written in some earlier version and even when it is written (via direct REST API), the filter doesn’t exclude results as it should. Monitors are saved in `.opendistro-alerting-config` which is not managed by tenants or workspaces, therefore the use has access to all of monitors (assuming they have access to the index) It seems at this moment, you can either limit the user from seeing any monitors, or seeing them all. I would recommend to raise a feature request for this [here](https://github.com/opensearch-project/alerting/issues) ---
**Author:** ![Santhosh.Gollapudi](https://avatars.discourse-cdn.com/v4/letter/s/e79b87/32.png) [@Santhosh.Gollapudi](https://forum.opensearch.org/u/Santhosh.Gollapudi)\ **Post date:** [May 12, 2026, 11:54am UTC](https://forum.opensearch.org/t/opensearch-tenants-vs-workspaces/28050/12 "2026-05-12T11:54:14Z")
Feature request submitted: [[FEATURE] Isolate the monitors, channels and recipient groups in OpenSearch · Issue #2140 · opensearch-project/alerting · GitHub](https://github.com/opensearch-project/alerting/issues/2140) ---
**Author:** ![spapadop](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/spapadop/32/950_2.png) [@spapadop](https://forum.opensearch.org/u/spapadop)\ **Post date:** [May 13, 2026, 7:42am UTC](https://forum.opensearch.org/t/opensearch-tenants-vs-workspaces/28050/13 "2026-05-13T07:42:08Z")
In our case we are actually moving from tenants to workspaces, as the latter seems like the way forward. I had raised a relevant thread on slack: > **[Slack | AI Work Platform & Productivity Tools](https://opensearch.slack.com/?redir=%2Farchives%2FC01QENNTGUD%2Fp1770975784836179%3Fname%3DC01QENNTGUD%26perma%3D1770975784836179)** > > Boost productivity and save time with Slack‌ — ‌the AI work platform for managing projects, automating workflows, and connecting teams securely. Start working smarter today. It’s true that now security roles no longer have “Tenant permissions”, as Workspaces have their own ACL, so we need to define the relevant permissions for the relevant people both on security plugin level and on dashboards separately. Since we’ve automated that it is not a big problem but indeed it’s a compromise to get into the future view already. At the same time, as Dashboards is moving towards a Grafana-like product with multiple data sources (not just OpenSearch), it makes sense that ACLs for Dashboards objects are kept on Dashboards-side. Also, workspaces have the concept of “use-case” so that each team can have a more focused environment, i.e, if a team only cares about simple Discover, Vizualisations and Dashboards, the “Essentials” use-case only show them those menu items, hiding the plethora of irrelevant features. ---
**Author:** ![muraliv](https://avatars.discourse-cdn.com/v4/letter/m/f05b48/32.png) [@muraliv](https://forum.opensearch.org/u/muraliv)\ **Post date:** [May 13, 2026, 1:24pm UTC](https://forum.opensearch.org/t/opensearch-tenants-vs-workspaces/28050/14 "2026-05-13T13:24:06Z")
We have a workaround to make sure that a user from tenant1 is not able to see a monitor created by a user from tenant2. This is by adding this to the rolesearch in the authz section of ldap configuration. ```auto rolesearch: "(&(|(cn=CSG_OPENSEARCH*)(cn=elm_*))(member={0}))" userroleattribute: null userrolename: "disabled" ``` Thanks Murali