A tenant administrator at a law firm creates user accounts and assigns application roles inside the firm's SaaS practice-management system, using the administrative console the provider exposes. Under the cloud reference architecture, how should this activity be classified?
Select an answer to reveal the explanation.
Short Explanation
The landlord installs the building's lock system, but you decide who gets a key to your apartment. Creating users and assigning roles in your tenant is the customer's job, done by the customer's administrator. The trap is thinking that because the provider built the identity feature, the provider is the one administering it.
Full Explanation
ISO/IEC 17789 models cloud computing activities by role. Under the cloud service customer role it defines sub-roles including cloud service user, cloud service administrator, cloud service business manager and cloud service integrator. Administering the customer's own use of a service, such as creating accounts, assigning roles and managing security settings within its tenancy, is a customer activity performed by the cloud service administrator. The provider supplies the capability, including the identity features and the administrative console, but operating that console for the tenant is the customer's work. Classifying the activity as the provider's because identity features belong to the managed application confuses who builds a capability with who uses it. Calling it a partner activity mislabels the firm's own administrator, who is not an auxiliary party supporting the customer; a partner would be an outside integrator or auditor. Claiming provider staff perform it under the SLA contradicts the scenario, where the firm's administrator acts directly through the console. Exam caveat: in SaaS this is exactly the residual customer duty most often neglected. Operational check: confirm that tenant administrator accounts are few, protected by multifactor authentication, and reviewed periodically for role assignments that exceed need.