Tenant Access

Prerequisites

• Parent account (sharing side): Account Admin role. The Tenant Access Manager feature must be activated for the account by a Service Admin or VAR Admin.
• Tenant account (receiving side): Account Admin role to accept the invitation and manage access for tenant users.
• At least one Resource Group created containing the resources to be shared.

Overview

Tenant Access (also referred to as the Tenant Access Manager) enables property owners and building operators to share resource access management with tenant organizations. Instead of managing all users centrally, the parent account delegates control over specific resource groups to tenant accounts, allowing each tenant to independently manage their own users' access to shared resources.

Key Capabilities:

• Share resource groups between a parent account and one or more tenant accounts
• Invitation-based workflow — tenants are invited via email and accept using a temporary code
• Full data privacy — user data is separated between parent and tenant accounts, maintaining GDPR compliance
• Audit trail — event history tracks all sharing-related activities across accounts
• Independent access management — tenant admins grant and revoke access for their own users without involving the parent account
• Share additional groups after the initial invitation without re-inviting the tenant

Tenant Access page showing shared accounts and invitation options

Navigation

To access Tenant Access:

1. Log in to your Bitwards Mobile Access account
2. Expand "Resources" in the left sidebar menu
3. Click "Tenant Access" from the submenu

How It Works

The Tenant Access workflow involves two parties: the parent account (building operator) and the tenant account (tenant organization). The parent account shares resource groups, and the tenant account manages their own users' access to those shared resources.

Data Privacy Between Accounts

User data is fully separated between parent and tenant accounts. Tenant admins can only view access history for their own users in the shared resources — not from other tenants or the parent account. Similarly, the parent account can monitor access transactions in shared doors but cannot see tenant users' names or identification details. This separation ensures GDPR compliance across organizations.

Features

Activating the Feature

The Tenant Access Manager must be enabled for your account before it can be used. A Service Admin or VAR Admin activates the feature in the account settings.

Account settings page showing the Tenant Access Manager feature activation

Feature Activation Required

The Tenant Access Manager is not enabled by default. Contact your Bitwards service administrator or VAR partner to activate this feature for your account before proceeding with the steps below.

Sharing Resource Groups with a Tenant

To share resources with a tenant organization:

1. Create a resource group containing the resources (e.g., common area doors) you want to share. See Resource Groups for instructions.
2. Select the resource group to share with the invited account.
3. Send an invitation by entering the recipient's information. The system generates an email containing a temporary code for accepting the invitation.

Invitation form where the parent account enters the tenant recipient's details

Selecting a resource group to share with the invited tenant account

Invitation Email

The invited tenant administrator receives an email with a temporary code. They will need this code to accept the invitation on the Tenant Access page in their own account.

Accepting an Invitation (Tenant Side)

When a tenant administrator receives an invitation:

1. Navigate to the Tenant Access page in their own Bitwards account.
2. Enter the invitation code from the email.
3. Press Confirm to accept the invitation.

After accepting, the tenant account gains visibility of the shared resource groups and can begin managing access for their own users.

Tenant Access page showing the invitation code input and Confirm button

Viewing Shared Accounts

After the invitation is accepted:

• Parent account view: The "Accounts shared" table shows all tenant accounts that have accepted the invitation. Click an account row to view which resource groups and schedules have been shared with that tenant.
• Tenant account view: The shared resource groups appear in the Resource Groups page under the "Groups shared with us" tab, distinguished from the tenant's own groups by a mark in the column.

Accounts shared table showing accepted tenant accounts and their shared resource groups

Sharing Additional Resource Groups

After a tenant has accepted the initial invitation, you can share more resource groups without sending a new invitation:

1. Click the tenant account in the shared accounts table.
2. Click "Share resource groups" on the account details page.
3. Select the resource groups you want to share, along with any attached weekly schedule if supported.

The admins in the receiving tenant account will receive a notification email about the newly shared resource groups.

Sharing additional resource groups with an already connected tenant account

Revoking a Shared Resource Group

To stop sharing a resource group with a tenant account, click the trash can icon next to the resource group you want to stop sharing.

Trash can icon to stop sharing a specific resource group with a tenant

Using Shared Resource Groups (Tenant Side)

Once a tenant account has received shared resource groups:

• The shared groups appear on the Resource Groups page alongside the tenant's own groups, identifiable by a mark in the Shared column.
• Tenant admins create access rights for their users or user groups by selecting shared resource groups — the same workflow as using their own resource groups.
• End users receive access rights to the Bitwards Mobile Key App and open doors normally.

Resource Groups page showing shared groups listed alongside own groups

How End Users Experience Shared Access

End users in the tenant account are not aware of the sharing arrangement. They receive access rights through the Bitwards Mobile Key App and use the app normally to open shared doors — no additional steps or consent from the resource owner is required.

Event History

The Tenant Access page includes a "See event history" button in the top-right corner. The event history functions as an audit trail, showing all events related to shared resource groups — such as invitations sent, accepted, groups shared, and groups revoked.

Click any row in the event history to view the details of that event.

Event history showing audit trail entries for shared resource group activities

Audit Trail for Compliance

The event history provides a complete record of all sharing activities. This is valuable for security audits and compliance reviews — you can track exactly when resource groups were shared, who accepted invitations, and any changes made to sharing arrangements.

Important Notes

NFC Cards Not Supported

Shared resource groups do not currently work with NFC card-based access rights. This is a known limitation as of release 2.31.0. Only mobile app-based access is supported for shared resource groups.

Privacy Boundaries

While both parent and tenant accounts can view access transactions for shared resources, each account can only see details for their own users. The parent account sees anonymized entries for tenant users, and tenants cannot see other tenants' or parent account users' activity.

Related Features

• Resource Groups — Create and manage resource groups before sharing them with tenants
• User Invitations — Invite users to your tenant account for access management
• User Groups — Organize tenant users into groups for efficient access assignment
• Weekly Schedules — Attach time-based schedules to shared resource groups