What is an Organization?

An organization is the Versa Director and Controller construct that represents a tenant, customer, or business unit – the container under which devices, templates, policies, and configurations are grouped and managed. Organizations nest hierarchically as provider and customer (tenant) levels, each isolated from the others, and share a single software license across their members.

Key takeaways

• An organization groups devices, templates, and policy under one license.
• Provider organizations own infrastructure; tenant organizations nest beneath them.
• A Global Organization ID (1–31) uniquely identifies each org network-wide.
• Shared Control Plane lets a tenant reuse its parent’s routing and tunnels.
• Removing an organization deletes its templates and device associations.

On this page: Why it matters · How it works · Types · Organizations & Versa · FAQ

Why are organizations important?

Every object in Versa Director hangs off an organization: appliances, templates, routing instances, users, and licenses are all scoped to one. Without that scoping, a single Director instance managing thousands of devices across many customers would have no way to separate one customer’s configuration, traffic, and visibility from another’s. The organization is the concrete configuration object – created in Director Workflows – that makes multitenancy real rather than theoretical.

Organizations also carry the software license. A VOS, Analytics, Director, or Controller device operates under the license bound to its organization, and child organizations inherit their parent’s license plan automatically, which is what makes multitenant licensing manageable at scale. That link between organization and license is why creating, modifying, or removing one is never a cosmetic change: removing an organization disassociates every device from it, deletes its hardware inventory, device groups, and templates, and moves any Versa Secure Access licenses tied to it into a terminated state.

What is an organization?

In Versa Director, an organization is configured through Workflows > Infrastructure > Organizations: a Name, a Global Organization ID (an integer from 1 through 31, unique across the network), and an optional Parent for multitenant hierarchies. Each organization selects an IKE authentication mode (preshared key or PKI), associates Controller nodes, CMS connectors, and Analytics clusters, and defines its own virtual routing instances – the isolated forwarding contexts that let overlapping IP addressing exist safely between organizations. A Shared Control Plane option lets a child organization reuse its parent’s control VR routing instance and IPsec tunnels to the Controller nodes instead of building its own.

Organizations also scope supported user roles and Versa Secure Access (VSA) license counts, and can be created through the guided Workflows wizard – the recommended path – or configured manually. After an organization exists, the recommended next step is creating at least one admin user and one non-admin user scoped to it; Configure AAA covers the provider-versus-tenant role split and the access each grants.

Types of organizations

Three forms recur in Versa Director. A provider organization sits at the top of the hierarchy: it owns Controller nodes, Analytics clusters, and licensing, and is where the first organization in any deployment is created. A customer (tenant) organization nests beneath a provider – created with the same Workflows wizard, but with the Parent field set to the provider’s name – and holds an individual customer’s or business unit’s own templates, routing instances, and users, isolated from siblings under the same provider. A suborganization nests further inside a tenant for deployments needing extra subdivision; suborganizations can be associated with device templates and autoprovisioned onto Controller nodes alongside their parent.

The distinction matters operationally, not just conceptually: creating a customer organization follows the identical procedure as creating a provider organization, differing only in which name is selected as Parent, and the Director UI reflects the hierarchy directly – double-clicking a provider organization in the left-hand tree expands its tenant organizations underneath it.

Organizations & Versa

The organization selector threads through nearly every Director screen: Analytics dashboards, alarm and log views, appliance monitoring, and RBAC configuration all start with picking an organization from a drop-down or the left-hand tree, then drilling into its tenants. Log Export Functionality (LEF) profiles are configured per organization – see Apply Log Export Functionality – and system health logs from multi-tenant VOS devices are exported in the provider organization’s context, since it is the appliance owner.

Configure AAA provisions two user types, provider and tenant (organization), each with its own default RBAC roles generated automatically whenever an organization is created; custom roles must be explicitly associated with the organizations allowed to use them. Device templates carry an Organization field that binds the template – and any suborganizations added alongside it – to the devices it can deploy to, which is how Configure Basic Features ties organizations, templates, and Controller nodes into one deployable unit.

Frequently asked questions

Is “organization” the same thing as “tenant” in Versa?

Largely, yes. Organization is the object configured in Director – the Name, ID, and Parent fields you set under Workflows. Tenant describes its role in the multitenancy hierarchy: a customer organization nested beneath a provider organization is what the documentation calls a tenant.

How many organizations can a Director deployment support?

Two independent numbers appear in the documentation, and they govern different things. The Global Organization ID field accepts values 1 through 31 – an identifier range, not a deployment ceiling. Separately, the overlay address scheme’s maximum-organizations parameter sizes the SD-WAN overlay’s private address space for a planned organization count of 64 through 2048 addresses generated per branch, and any plan for more than 128 organizations must use the larger 10.0.0.0/8 prefix rather than a smaller RFC 1918 range. Neither number alone answers the capacity question – the ID range constrains identifiers while the address scheme is a capacity-planning input, and Versa’s configuration guide does not state a single overall organization limit.

What is the Global Organization ID used for?

It uniquely identifies an organization across the entire network, in the range 1 through 31. Director auto-populates the next available value when you create an organization, but you can override it manually as long as the value you choose stays unique network-wide. Note this ID range is unrelated to the overlay address scheme’s 64–2048 maximum-organizations sizing parameter – see the capacity question above.

What happens when an organization is removed?

Removal decommissions the organization: it is disassociated from every VOS device that used it, its hardware inventory and device groups are deleted, all of its device templates are deleted, and any Versa Secure Access user licenses tied to it move into a terminated state.

What does enabling Shared Control Plane do for a tenant organization?

It lets the tenant organization reuse its parent’s control VR routing instance and IPsec tunnels to the Controller nodes rather than building its own. Without it enabled, the tenant gets a dedicated control routing instance and its own dedicated tunnels to the Controller nodes.

More on Versa organizations

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about organizations, these are worth looking at next.