Home > Multi-tenant administration > Tenant lifecycle automation with Platform Operations

Tenant lifecycle automation with Platform Operations

Last updated: 2026-11-03

Cadence: Weekly (CICD review) and Quarterly (drift review)

Subscription model: Multi-tenant subscriptions

Roles: Tenant Admin (TA), Analytics Admin (AA), Service Account Owner (SAO)

Last verified: 2026-05

	Initial	Recurring
Estimated time	2 days	1 hr weekly / 4 hr quarterly

Benefits:

Standardized tenant provisioning, configuration, and content deployment
Reduces drift between tenants under the same subscription
Provides an auditable, repeatable path for tenant onboarding and decommissioning

Goal

The Qlik Platform Operations connector for Qlik Automate is the no-code path for cross-tenant work; the same operations are also available pro-code via the Qlik REST APIs and qlik-cli. The connector supports tenant-level or region-level OAuth and includes blocks for: getting tenant / region from a hostname, getting license overview, creating tenants, configuring auto-license assignment, seeding groups and spaces, importing apps and automations, copying users, and more.

Common automations to standardize

Provision a new tenant in a chosen region from a region-level OAuth client. (Create a new tenant with Platform Operations)
Configure a freshly provisioned tenant with standardized auto-license rules, baseline groups, baseline spaces, and feature toggles (Configure a tenant with Platform Operations); then deploy required themes / extensions (Deploy themes and extensions with Platform Operations) and any web-origin / CSP entries needed by those extensions (Add custom themes and extensions to a tenant). IdP setup is a separate operation (see Identity providers in Qlik Cloud).
Onboard users into a target tenant (copy from a source tenant or trigger on-login). (Add a user to a tenant, Deploy an automation to a tenant)
Promote content from a source tenant (Dev) to one or more target tenants (Test, Prod, and regional copies). The connector now supports passing a full tenant hostname and works with Qlik Cloud Government for read operations. (Connector updates)

Tasks

Task	TA	AA	SAO
Maintain a library of standardized Platform Operations automations (provision, configure, content-deploy, user-onboard, decommission) (see gotchas: qlik tenant deactivate hostname header, SLK replacement wipes entitlement assignments)	✓	✓
Run / monitor cross-tenant CICD automations on each release (Dev → Test → Prod) (see gotchas: re-import each run drops Community/Personal bookmarks)	✓	✓
Review the bot-user account that each Platform Operations automation runs as in each target tenant; remove orphans	✓		✓
Keep automation ownership on a service / shared account, not on an individual whose departure would break runs	✓	✓
Spot-check standardized configuration drift across tenants (User Default permissions, allowlists, web integrations, themes, baseline spaces and groups)—quarterly	✓

Read before acting—gotchas

Platform Operations and tenant lifecycle:

qlik tenant deactivate requires a qlik-confirm-hostname header that isn't in the help text and isn't auto-added by qlik-cli; without it the call returns Precondition failed. Document the exact deactivation command in your decommissioning runbook.
Updating the Signed License Key (SLK) on a tenant immediately wipes all user entitlement assignments with no rollback—Professional / Analyzer / Full / Basic entitlements are bound to the license, not the tenant (security-role assignments such as Tenant Admin aren't affected). Per Qlik's migration guidance, when changing entitlements, all assignments will be lost. Before changing the subscription / entitlement on an existing tenant, export the entitlement assignments and plan a re-import. Re-applying the original SLK doesn't restore them. (community)
Repointing a tenant alias to a new tenant during a license / capacity migration is a coordinated Qlik Support engagement. DNS propagation can take up to 24 hours; users connected during the cutover typically see a short navigation hiccup that resolves with a refresh. Communicate the cutover window and document a freeze period. (alias help)
Region selection is one-way—region moves aren't self-service; contact Qlik Support to discuss available options. Single-tenant subscriptions include one tenant total; multi-tenant subscriptions can deploy multiple tenants subject to the subscription's tenant-count entitlement. Plan OEM expansion and data-residency strategies up front.
Cross-tenant content promotion via Platform Operations re-imports the app each run. Only Public bookmarks survive an export/import; Community and Personal bookmarks (and any links / shares anchored to deleted app or bookmark IDs) are lost when Import and replace app in shared space deletes the prior copy. For single managed app, many tenants patterns, publish-and-replace into a managed space rather than re-import. (Qlik Support: bookmarks deleted on import/replace)

Qlik Talend Cloud (post-July 22, 2025 unification):

TMC artifact storage URL changed in November 2025 from minio.<region>.cloud.talend.com to storage.<region>.cloud.talend.com. Un-allowlisted firewalls and stale keystores break Remote Engine deployments silently.
Talend Remote Engine pairing failures (No Engine found with Pre-authorized key) recur from key reuse and stale remote.engine.id / /data caches. Re-pair via fresh install with a blank engine ID and cleared /data directory.

Automation helpers

Export automation to GitHub—Version-controls the standardized Platform Operations automations.
Import automation from GitHub—Promotes the standardized automations into target tenants.

References

Tags: #weekly #quarterly #multi_tenant #platform_operations #cicd #automation

Did this page help you?

If you find any issues with this page or its content – a typo, a missing step, or a technical error – please let us know!

Leave your feedback here