---
title: "Using tenant federation | Grafana Enterprise Metrics documentation"
description: "Overview GEM supports creating access policies that can span multiple tenants. Doing so enables viewers in Grafana Enterprise to view data coming from more than one tenant simultaneously. For example, if there were a tenant called team-engineering and a tenant called team-finance, an administrator might want to query metrics from both tenants simultaneously."
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

Important: This documentation is about an older version. It's relevant only to the release noted, many of the features and functions have been updated or replaced. [Please view the current version](/docs/enterprise-metrics/latest/).

[Documentation](/docs/)![breadcrumb arrow](/static/assets/img/icons/grafana-icon-breadcrumb-arrow-gray.svg) [Grafana Enterprise Metrics Documentation](/docs/enterprise-metrics/v1.7.x/)![breadcrumb arrow](/static/assets/img/icons/grafana-icon-breadcrumb-arrow-gray.svg) [Manage a tenant](/docs/enterprise-metrics/v1.7.x/tenant-management/)![breadcrumb arrow](/static/assets/img/icons/grafana-icon-breadcrumb-arrow-gray.svg) Using tenant federation

Enterprise

## Overview

GEM supports creating access policies that can span multiple tenants. Doing so enables viewers in Grafana Enterprise to view data coming from more than one tenant simultaneously. For example, if there were a tenant called `team-engineering` and a tenant called `team-finance`, an administrator might want to query metrics from both tenants simultaneously.

## Prerequisites

- A configured Grafana Enterprise Metrics cluster. To create a GEM cluster, refer to [Set up GEM](../../setup/).
- This guide will assume there are two tenants: `team-engineering` and `team-finance`. To create a tenant, refer to [Set up a GEM tenant](../../set-up-gem-tenant/).

## Set up an access policy with tenant federation and a token

To allow queries to span both GEM tenants, which are for demonstration purposes named `team-engineering` and `team-finance`, create a new access policy called `leadership`. The necessary steps are:

1. Create a new access policy `leadership`.
2. Enable the `Read` scope.
3. Add the tenants `team-engineering` and `team-finance`. Alternatively, you can add the special tenant name `*` to create an access policy that has access to all tenants in the cluster.
4. Create a new token for the access-policy and store the token in your clipboard:

Your browser does not support the video tag.

## Set up a Grafana data source using the access policy

1. Create a new Prometheus data source from the Grafana configuration menu.
2. Enter the URL of your GEM cluster, for example `http://metrics-enterprise/prometheus`.
3. From the **Auth** section, enable Basic auth.
4. In the **User** field, enter: `team-engineering|team-finance` where all the names of the tenants that you want to query across are separated by the `|` pipe character.
5. In the **Password** field, paste the token created in the token creation process.

Queries that are performed using this data source in either Explore or inside of dashboards are performed across all of the tenants that you specified in the **User** field, and are processed as if all of the data were in a single tenant.

To submit a query across all tenants that your access policy has access to, you can either:

1. Explicitly set the name of all the tenants separated by a pipe character “|” in the *username*. For example, to query across `tenant1`, `tenant2`, and `tenant3` you would enter `tenant1|tenant2|tenant3`.
2. Set the username to a wildcard character “\*”. This will query all tenants that the access policy grants you access to, without requiring you to explicitly specify the their names.

When using an access policy that has a wildcard (`*`) as the *username*, you can query all tenants for that cluster by also specifying `*` as the *username* in your data source URL.

Conversely, if you use a wildcard *username* in your data source URL with an access policy with specific tenants, that data source has access to only those tenants.

Your browser does not support the video tag.