External access and partner delegation

In a multi-tenant environment including two or more tenants, wherein a management console provides administration resources for each tenant and also stores data for each tenant, a method for a user associated with the second tenant to obtain permission to access resources and/or data of the first tenant, the method comprising:

• receiving at the management console a user request of a user associated with the second tenant for access to a resource and/or data of the first tenant to perform operations,
• determining at the management console identity criteria of the user;
• mapping at the management console the user to an external access object based on the identity criteria, wherein the external access object is configured to represent the user when performing operations on the resources or data of the first tenant;
• and
• determining at the management console if the user has permission to access the requested resource and/or data and to perform the operations based on the mapping to the external access object.

A computing system comprising the following:

• one or more processors;
• system memory;
• one or more computer-readable storage media having stored thereon computer-executable instructions that, when executed by the one or more processors, causes the computing system to perform a method for a user associated with a second tenant to obtain permission to access resources and/or data of a first tenant to perform contracted operations, the method comprising the following:
• negotiating a service agreement between the first and second tenants, wherein the second tenant contracts to perform specified operations on the resources and/or data of the first tenant;
• determining identity criteria for one or more users associated with the second tenant who will provide the contracted for specified operations;
• receiving at the management console a request from one of the one or more users associated with the second tenant for access to the resource and/or data of the first tenant that are to be subjected to the specified operations;
• mapping an external access object to the one of the one or more users based on the identity criteria, wherein the external access object is configured to represent the one of the one or more users when performing the specified operations on the resources and/or data of the first tenant;
• associating the external access object with a set of the one or more administrative tasks, wherein the set of administrative tasks define the specified operations that may be performed on the resources and/or data by the one of the one or more users;
• determining if access is to be granted to the resources and/or data of the first tenant by determining if the one or more administrative tasks are permitted by the external access object;
• and
• determining if a designated target object is permitted to be subjected to the one or more administrative tasks.