Each domain owns its own everything
Users, applications, journeys, roles and policies belong to the domain. Not a filtered view of one shared pool — a separate set, with its own administrators and its own data.
Multi-domain
Govern the whole group.
A group is not one company, and a merger does not turn two companies into one on the day the deal closes. Monokee runs each organisation as its own domain — its own users, its own applications, its own policies — inside a single tenant, with one place to look and an identity that can cross when somebody is entitled to.
One tenant, real separation
Separation by design, not by convention
The usual way to serve several organisations from one platform is a naming convention and a lot of discipline. It works until the first mistake, and the first mistake in a group is the one that reaches a company it was never meant to reach.
A privileged account can cross
A group IT function can hold rights in several domains and administer them from one console. That is the reason for having a tenant at all; without it you have separate installations with a shared invoice.
The parent can see the group
Oversight and reporting across every domain, without anybody inside a domain seeing the ones next door. The visibility goes up the structure, not sideways.
Nobody has to consolidate first
Domains keep their own identity providers. Entra ID in one company, Okta in another, an on-premises directory in the one that joined last year — and none of it has to be resolved before the group gets a single view.
Where it earns its keepGroups and holdings Mergers and acquisitions
Two situations where one directory is the wrong answer
Both of them are structural. Neither is solved by a better naming scheme, and in both the cost of getting it wrong lands on the business rather than on IT.
A holding does not employ the people who work in its subsidiaries
Each company has its own payroll, its own works council, often its own regulator and its own country. Consolidating their identities into one directory to obtain one console is a legal and organisational argument that will outlast the project that started it. What the parent actually needs is different: oversight of who can reach what across the group, one place to look, and the ability to put a group-level policy on top without dissolving the companies underneath.
- Separate legal entities that stay separate
- Group-level visibility without merging directories
- Rules that differ by country and by sector, by design
- A group IT function that can administer all of them
On the day the deal closes, two IT estates become one balance sheet and stay two IT estates
Everyone in the room knows the identity consolidation will take a year and a half. The business needs shared access next month. The usual answer is a migration project, and the migration is where the value of the deal goes to wait. Running the acquired company as its own domain from week one inverts the order: shared access first, consolidation when it is worth doing.
- Shared applications on day one, without touching either directory
- The acquired company keeps its identity provider until moving is worth it
- Decommissioning happens when convenient, not when it is blocking
- Divestment works the same way in reverse — a domain leaves without unpicking a merged directory
How it works
One authentication, credentials that never mix
The user signs in once. The credential authority holds a separate set of credentials for that person in every domain they are entitled to reach, each carrying its own level of access. The device receives the set, and then talks to each domain with that domain's credentials only — so nothing about one organisation travels to another, and moving between domains does not send anybody back to a login page.
The mechanism is patented: EP 3 794 476 andUS 11,799,870, with equivalents granted in Israel and China, from a 2019 priority filing.
Siblings
The same person, a different identity in each domain
Domains can be linked by trusted relationships, so somebody entitled to more than one can move between them without authenticating again. What travels is the person, not the permissions: Monokee calls the linked accounts siblings — one identity per domain, each holding exactly the roles that domain granted.
A group finance director is an administrator in one subsidiary's domain and a read-only reviewer in another. The human being is the same; the identity is not, and neither domain has to know what the other decided. That is what makes the arrangement survive an audit of either company on its own.
- One identity per domain, linked to one person
- Roles and privileges granted by each domain independently
- Switching domains ends the session in the one being left
- Trusted relationships decide which transitions are allowed at all
The alternatives01 02 03
Three ways to solve this, and what each one costs
Worth being explicit about, because all three are defensible and organisations usually try two of them before arriving here.
One directory for everyone
You get the single console and you lose the separation. Every entitlement in the group becomes a filtering problem, and the first misconfiguration is a cross-company data incident rather than a support ticket.
One tenant per company
You keep the separation and you lose the group. Nobody can answer "who has access to what across the organisation" without assembling a spreadsheet, and every group-wide policy gets implemented as many times as there are companies.
Consolidate first, then govern
The honest answer, and the slow one. It is usually right eventually and almost never right now — which is why it tends to be announced, budgeted, and then quietly rescheduled.
Multi-domain is the fourth: keep the separation, get the group view, and leave the consolidation as a decision rather than a prerequisite.
Bring us your org chart
We'll map it onto domains with you and show you what stays separate and what doesn't.
Ask for a demo