Zenconsole: central management of Zenarmor for multiple sites and customers

Zenconsole is Zenarmor's cloud management portal (dash.zenarmor.com). It lets you manage every Zenarmor gateway and endpoint agent from a single console: central policies, reporting, users and zero-trust access for all your sites at once. For an organisation with several branches, that means one policy instead of ten separate firewall configurations. For an MSP, it means one console with a separate environment per customer. Zenarmor 2.6 and 2.7 (June and September 2026) added an audit trail, an organisation-based REST API and a selectable storage region for central reporting, including the Netherlands and Germany.

In this article we explain, as an official Zenarmor partner in the Netherlands and an independent ISO 27001 Lead Auditor, how Zenconsole is structured, what you can and cannot manage centrally, which roles and permissions exist, how data residency and sovereignty work, and how Secrotec delivers Zenconsole as a managed service.

What exactly is Zenconsole?

Zenconsole is the SaaS management layer that sits above the Zenarmor engine. The engine itself runs locally: as a plugin on OPNsense, as a package on pfSense CE, FreeBSD or Linux, as a container, or as an agent on a laptop or phone. The console collects those instances, distributes policy and presents the reporting. One point matters a lot: enforcement stays local. Your traffic does not have to be backhauled through an external inspection point of presence. Zenconsole is the management and reporting layer, not a pipe your data has to flow through.

Zenconsole offers two ways of working:

• Standalone firewall management. Each firewall keeps its own policies, but you see and manage all of them from one portal. You group firewalls into projects; Zenarmor's documentation literally describes a project as a folder per branch office or, for an MSP, per client.
• Organisation management (Central Organization Management). Policies are defined centrally in Zenconsole and apply to every gateway and endpoint in the organisation. This is the model for genuinely central policy, identity-based rules and ZTNA (Zenarmor overview).

Aspect	Standalone firewall management	Organisation management
Where do policies live?	Locally on each firewall	Centrally in Zenconsole
Grouping	Projects (per branch or client)	Organisation with gateways, endpoints and tags
Roles for colleagues	Owner, Admin, Operator, Viewer	Owner, Admin, Viewer
Endpoints and ZTNA	Not centrally managed	Agents, zero-trust networks, posture checks
Typical use	A few firewalls managed locally	Multiple sites, hybrid workers, MSP customers

Organisations and the multi-tenant structure

An organisation in Zenconsole is the container in which you register gateways (OPNsense, pfSense CE, Linux) and endpoints (Windows, macOS, Linux and mobile). Within it you manage users, either manually or through an identity provider such as Entra ID, Google Workspace or Okta. Since release 2.6 you can also label gateways and endpoints with system or custom tags, for example by region, department or risk class, which keeps reporting and policy per group manageable.

What you get depends on the subscription. For a long time the documentation tied Central Organization Management to SSE and higher. With release 2.7, Zenarmor made the organisation feature available to all editions. The current plans page lists "cloud-based central organizational management" for Unified Secure and Unified Secure Plus, with a single tenant, while client and tenant management for partners belongs to the SSE, ZTNA and SASE plans. For one organisation with several branches, Unified Secure (Plus) is therefore often enough; an MSP that wants to manage multiple customers in isolation ends up in the enterprise and partner tier. Because Zenarmor extends features with every release, we always check the current position for your scenario.

What multi-tenant means in practice

Multi-tenant means that every customer or subsidiary gets its own isolated environment: its own policies, its own reporting and its own administrators. At the same time, the engineer at the MSP sees everything from a single login. Zenarmor's MSP page explicitly mentions isolation of policy, data and visibility per tenant. For an auditor this is not a detail: it prevents the administrator of customer A from accidentally viewing the logs of customer B, and it makes responsibilities per customer demonstrable.

Central policies: define once, enforce everywhere

Within an organisation you define internet access policies and private network policies centrally. A policy combines security rules (malware, phishing, botnet C&C), application control, web filtering, TLS inspection and exclusions. You apply it based on criteria such as interface, VLAN, network, device, user, group and time schedule. Since 2.7, organisation policies can also reference users and groups from a classic Active Directory or LDAP directory, which eases the move for organisations with an existing Windows domain. For the building blocks, see our articles on application control and the Zenarmor web filter.

Baseline policies as templates

Since 2.6, Zenconsole can back up and restore internet security policies: you export several policies into a single file and import them elsewhere. We use this as a template mechanism. Secrotec maintains a baseline set, for example "office", "guest network", "IoT/OT" and "administrators", aligned with ISO 27001 Annex A and NIS2 Article 21. For a new site or customer, we roll out the whole set in one go. Site-specific deviations are then added deliberately and documented, so that during an audit you can explain exactly why a branch differs.

Watch out when migrating existing firewalls

A firewall that already has local policies cannot simply be added to an organisation. According to Zenarmor's documentation, you first back up the local policies; they are then removed, because policy will from now on be managed centrally. Such a backup can only be restored to a standalone instance, not to a node that already belongs to an organisation. Plan the migration site by site, with a maintenance window and a central policy that has been rebuilt and tested beforehand.

Audit trail: who changed what?

For ISO 27001 and NIS2 it is not enough for a firewall to be configured correctly. You also need to show who makes changes and when. Zenarmor 2.6 introduced an audit trail in Zenconsole that records administrator actions such as policy updates, configuration changes and adding or removing instances. Release 2.7 added audit logs for endpoint applications and OPNsense gateways, covering logins and logouts, engine status changes, updates and changes to zero-trust networks (see the release notes).

As auditors we map this directly to controls: ISO 27001:2022 A.8.15 (logging), A.8.32 (change management), A.8.2 (privileged access rights) and A.5.15 (access control). For NIS2 Article 21, and in the Netherlands the Cyberbeveiligingswet in force since 15 August 2026, it provides evidence for the management of network and information systems and for your access policy. How to use logging and reporting as evidence is covered in Zenarmor reporting for NIS2 and ISO 27001.

Roles and permissions

Zenconsole uses role-based access. Within an organisation you manage administrators under Settings > Administrators with the + Add Admin button (documentation). For standalone firewalls you share a node through the Sharing menu; according to Zenarmor, only the owner can do this, and only with a paid subscription.

Role	In an organisation	On a standalone firewall	Typical holder
Owner	All rights, including user and role management; only the owner can share the organisation	All rights, including removing the firewall	Lead administrator or contracting party
Admin	Engine and policy management, firewall configuration; cannot delete users or change roles	Almost everything except deletion; may share	MSP engineer, IT operations
Operator	Not available	Configure firewalls and manage policies, no sharing	Second-line support
Viewer	Read-only: configuration, reports, live sessions	Read-only	Security officer, management, auditor

Our advice: keep the number of owners to a minimum, give the customer or security officer a viewer role for transparency, and always use personal accounts rather than shared ones. An audit trail where "admin@company" is the only user is of little value to an auditor.

Central reporting and data residency: the Netherlands or Germany

Zenconsole combines the reporting from all gateways and endpoints into one view: threats, blocked applications, web categories, users and devices. Cloud retention depends on the plan. According to the plans page it is one day for Free and Home, 15 days for Unified Secure, 30 days for Unified Secure Plus and 90 days for the enterprise plans.

Important for European organisations: since 2.6 and 2.7 you can choose the region of the central reporting data store. The release notes list, among others, the Netherlands and Germany, as well as Finland, Sweden, the United Kingdom and regions outside Europe. The plans page shows a "customizable data residency region" as an option on request. We arrange that choice during onboarding.

Sovereignty: what you do and do not achieve

• Enforcement stays local. Inspection happens on your own gateway or endpoint; there is no mandatory detour through a foreign data centre.
• Reporting in the EU. Choose the Netherlands or Germany as the region for central reporting.
• Logs fully under your control. If you do not want log data in any cloud, use local reporting (Elasticsearch or SQLite on the gateway) or stream reporting data to your own Elasticsearch, syslog server or SIEM.
• To be fair. Zenarmor is a US company (Sunny Valley Cyber Security Inc.) with a European office in Frankfurt. Include Zenconsole in your supplier assessment (ISO 27001 A.5.19 to A.5.23) and, where personal data is processed, in your DPIA. For the strictest requirements, the plans page mentions "fully sovereign, self-hosted central management" for the enterprise plans.

Endpoint agents and ZTNA from the same console

Zenconsole manages more than firewalls. The same console deploys endpoint agents for Windows, macOS, Linux, Android and iOS, with mobile roll-out through Intune or Jamf. The same policy therefore applies to staff working from home or on the road. Since 2.5, agents can be updated automatically through Zenconsole and you can enforce re-authentication across the organisation.

For zero-trust access you build encrypted peer-to-peer mesh networks (overlay networks) in Zenconsole, with split DNS and device posture checks: only managed, healthy devices get access to internal applications. Release 2.7 added "Direct Access", which keeps peers connected when coordinator or relay servers are offline. How ZTNA, SSE and CASB fit together is explained in Zenarmor: beyond NGFW.

REST API and automation

If you manage many sites or customers, you do not want to do everything with a mouse. Zenarmor offers a REST API on the gateway for policy management, reporting data and exclusions, among other things. Since 2.6 there is also an organisation-based API in Zenconsole that lets you create gateways and retrieve organisation details. Release 2.7 extended it so that policies and zero-trust networks can be defined programmatically. According to the plans page, API management covers gateways in the standard plans and also endpoints and full management in the enterprise plans.

Practical uses: provisioning new branches automatically (2.5 introduced bulk provisioning through an installation script and bulk gateway updates), keeping policies as code under version control, and feeding reporting data into a ticketing system or SIEM.

High availability

A centrally managed network also has to be redundant where it matters. On OPNsense, Zenarmor supports high availability with synchronisation of Zenarmor settings and policies between the nodes of a cluster. The plans page lists "gateway HA with configuration synchronization" from Unified Secure upwards. You install the plugin on every cluster node. Zenconsole itself is a SaaS service; because inspection happens locally, the console is the management and reporting layer rather than a link in the data path.

Scale scenarios: who benefits from Zenconsole?

Scenario	Typical situation	What Zenconsole delivers
Multi-site SMEs	3 to 20 sites, OPNsense at each site, hybrid workers	One policy for every site, central reporting, agents for home workers
School boards and trusts	Many schools, guest networks, student devices	Web filtering and SafeSearch per audience, time schedules, per-school view via tags
Healthcare groups	Several practices or locations, NEN 7510 or ISO 27001	Consistent segmentation and logging, audit trail as evidence, reporting in an EU region
Retail chains	Many small stores, point-of-sale systems, IoT	Standardised baseline, device identification, central updates
MSPs and IT service providers	Dozens of customers, each with its own environment	Tenant isolation, roles per customer, API automation, pooled licences

Zenarmor's published customer stories show that this works. According to Zenarmor's story, the Dutch accountancy and advisory firm De Hooge Waerder manages five offices centrally in Zenconsole, with Zenarmor SSE on OPNsense and enforcement on Windows and iOS devices. In that story Secrotec is quoted as a Netherlands-based ISO 27001 Lead Auditor and Zenarmor partner. Read more about the approach in How SSE, CASB and DLP stop confidential uploads to WeTransfer. Zenarmor also publishes examples from Germany and France, such as a social care organisation with 45 sites and a municipality securing its schools. For healthcare providers, our NEN 7510 audit is relevant too.

Zenarmor for MSPs: the partner model

For managed service providers, Zenconsole is the strongest reason to choose Zenarmor. You manage every customer from one console, without logging in to a separate firewall per customer, while keeping policies, data and administrators separate for each one. Zenarmor works with a pooled licensing model for partners: a shared pool that you allocate across customers and can reallocate as they grow or shrink. The exact terms depend on the agreement, and we are happy to walk you through them.

Bear in mind that as an IT service provider you may fall under NIS2 yourself. See our NIS2 preparation and compliance service. A well-configured audit trail, separation of roles and documented baselines in Zenconsole help you demonstrate that you are in control of your customers' management environment.

Are you an MSP that wants to offer Zenarmor? Secrotec is listed on Zenarmor's partner list as an IT Security Service Provider in the Netherlands, delivers Zenarmor licences and projects throughout Europe, and can help you set up your first tenants, baselines and reports.

How Secrotec delivers Zenconsole as a managed service

The difference from an ordinary reseller: we are auditors too. We configure Zenconsole so that its output, from policies and logging to role assignments and reports, can be used directly as evidence in an ISO 27001 or NIS2 audit. Zenarmor supports compliance, but it does not make you compliant on its own; you still need the ISMS around it. Secrotec supplies licences with a partner discount, and in Zenarmor projects the price is always negotiable. See our Zenarmor partner page, the price comparison or our Firewall & Networks overview. Want to set up a gateway yourself first? Follow our guide on how to install Zenarmor on OPNsense.