Mastering Workspace Isolation: Multi-Tenant Access Control with Kibana Spaces

As organizations scale, managing a shared data platform across multiple business verticals like Finance, Marketing, and Operations can quickly become chaotic. Without proper segmentation, teams are forced to sift through irrelevant dashboards, accidentally modify each other’s visualisations, or worse, view sensitive data they shouldn’t have access to.

Fortunately, you don’t need to deploy separate infrastructure for every department. By leveraging Kibana Spaces alongside Elastic’s robust Role-Based Access Control (RBAC), you can create isolated, secure, and tailor-made environments for each business vertical while keeping your underlying deployment unified.

What is a Kibana Space?

A Kibana Space is a virtual container within a single Kibana instance that lets you organize and partition your saved objects.

  • Logical Isolation: Dashboards, visualizations, data views, and canvas workpads are kept completely separate. A dashboard built in the Finance space remains entirely invisible to users in the Marketing space.
  • Shared Performance: All spaces share the same backend Elasticsearch cluster, meaning zero hardware overhead or duplicate maintenance.
  • Tailored User Experiences: If the Marketing team only needs the Dashboard app and doesn’t use advanced developer tools, administrators can disable unused applications strictly within that space.

Blueprint: Implementing Multi-Vertical Access Control

To successfully secure and separate workspaces based on business verticals, you must align your Kibana Spaces (view layer) with Elasticsearch Roles (data layer). Here is the step-by-step implementation guide.

Step 1: Initialize Dedicated Spaces

First, set up clean virtual boundaries for each team.

  1. Navigate to Stack Management > Spaces in .
  2. Click Create a space.
  3. Name your space (e.g., Finance-Vertical or Marketing-Vertical).
  4. Under Customize features, toggle off any applications that the team does not require to declutter their sidebar.

Step 2: Restrict Data Privileges (Elasticsearch Layer)

Since all spaces pull from the same cluster, preventing a user from seeing another team’s raw logs requires data-level boundaries.

  1. Go to Stack Management > Roles and click Create role.
  2. Name the role according to the department (e.g., finance_analyst_role).
  3. Under Index privileges, specify the exact index pattern for that vertical (e.g., logs-finance-* or metrics-finance-*).
  4. Grant the required data permissions—typically read and view_index_metadata.

Step 3: Link Spaces to Roles (Kibana Layer)

Now, tie the data restrictions back to the visual workspace.

  1. Within the same role configuration page, locate Kibana privileges.
  2. Click Add Kibana privilege.
  3. From the Spaces dropdown, select the dedicated space you created in Step 1 (e.g., Finance-Vertical).
  4. Set the access level. Granting All allows the team to build dashboards within their container, while Read limits them to viewing existing data.

Step 4: Provision User Access

Finally, assign your users to their respective roles.

  1. Go to Stack Management > Users.
  2. Create or select a user account.
  3. Assign them their vertical’s custom role (e.g., finance_analyst_role).

The Result

The next time a Finance analyst logs in, they are dropped automatically into an environment containing only finance-focused dashboards and backed exclusively by finance indices. They remain entirely unaware that a Marketing space even exists, creating a seamless, secure, and focused user experience.

(Visited 1 times, 1 visits today)