# Single Tenant

A single-tenant on Unique is a separate, isolated, regulated and governed deployment of our product within our own Azure perimeter. Customers that opt for this approach get their own landing-zone that they can reach e.g. with `https://customer.unique.app`.

---

## Get started  
Refer to [Single Tenant Vending Form](https://docs.unique.ai/it-operators/installing-and-upgrading-unique/install-unique/single-tenant/single-tenant-vending-form)

## Tenant setup  
Unique built their setup according to Azure's [What is a Landing Zone?](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/) and their [Architecture of an AKS regulated cluster for Payment Card Industry Data Security Standard v3.2.1](https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/containers/aks-pci/aks-pci-ra-code-assets).

For every detail you can not find in our concept, refer first to the official Azure documentation.

The tenant used here adheres to the [Principle of Least Privilege](https://learn.microsoft.com/en-us/azure/active-directory/roles/best-practices#1-manage-to-least-privilege). To do so, we leverage Privileged Access Management and Conditional Access.

| **Property** | **Scenario** |
| --- | --- |
| Azure Active Directory | As outlined above, for single-tenants we use a heavily governed AAD tenant. |
| Management Group<br>**Unique Enterprise** | Our top level management group |
| Management Group<br>**Landing Zone Customer 1 (…n)** | Each customer has their own management group in order to leverage one subscription per customer |
| Subscription<br>**Landing Zone Subscription 1 (…n)** | Each customer has their own subscription so we can leverage the full capabilities of RBAC, Security Policies, Privileged Access Management and Conditional Access based on a customer's need |

## Tenant architecture  
This is Unique's implementation of our own [Infrastructure requirements/pre-requisites](https://docs.unique.ai/it-operators/installing-and-upgrading-unique/infrastructure/infrastructure-requirements-pre-requisites) with additions to empower Terraform and Audit Logs.