Tenants

Updated: April 15, 2026

Want to summarize with AI?

A tenant is a logical container that provides policy isolation and domain-based access control within the fabric.

A tenant (fvTenant) is a logical container for application policies that enables administrators to implement domain-based access control.

Provides policy isolation.
Groups policies for customers, organizations, or administrative domains.
Supports IPv4, IPv6, and dual-stack network configurations.

Tenant components and configuration

A tenant contains filters, contracts, external networks, bridge domains, VRFs, and application profiles with endpoint groups (EPGs). Objects in a tenant inherit the policies of that tenant.

The following configuration guidelines apply to tenants:

Tenants can be isolated from one another or configured to share resources.
You must configure a tenant before deploying any Layer 4 through Layer 7 services.
You can associate each VRF with multiple bridge domains.

Note

In the APIC GUI tenant navigation hierarchy, a VRF, also called a context, is labeled as a private network.

The following figure shows the tenant portion of the management information tree (MIT).

Figure 1. Tenant management information tree

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.