If a tenant's contract ends, you can restrict tenant access to the Sentinel server by disabling the tenant. When you disable a tenant:
All users associated with that tenant can no longer access the Sentinel server or use any of the REST APIs.
Data collection continues until the tenant stops sending data or until you have disabled the relevant data collection nodes.
MSSP users associated with the default tenant will no longer see the disabled tenant in Sentinel functions where they could choose a tenant. For example, when creating real-time views or setting the tenancy for a role.
You can still see the disabled tenant in the Tenants interface and when you select Show disabled.
You cannot delete tenants because MSSP employees may want to run reports for a disabled tenant or verify whether they are still receiving events from a disabled tenant.
To disable a tenant:
From Sentinel Main, click Users > Tenants.
In the list of tenants, click Disable for the tenant that you want to disable.