Multi-tenancy documentation

I am looking for the multi-tenancy documentation: practices to create a tenant/group/ and tenant’s providers the best way: is there one ?

on hammer-10 vsphere appliance, single instance:
I have created a child tenant and a group with the role evmrole-super_administrator but i cannot login with it: " Unauthorized".

There’s a brief description of tenancy with regard to automate here, but it may be a useful general overview.

The thing to keep in mind is that groups are members of tenants, and users are members of groups. A user therefore becomes part of a tenant through that user’s group membership.

Groups have roles, but roles are not tenant-specific so for example several groups in different tenants can share the same role.

As a matter of course I normally clone the standard roles such as EvmRole-user or EvmRole-administrator to my own roles such as MyOrg_Role-user, which means I can fine-tune the product features that groups with that role can see.

Hope this helps,
pemcg

i have done that.

My new tenant has exactly the same permissions than standard super administrator.

i can create a new virtual provider, but it disappear immediatly after clicked on add , like if i had not right to see the provider i have just created.

what could be the problem?