Access control for multi-tenant office buildings

Multi-tenant office buildings are their own discipline. A single-tenant building has one decision maker and one population of users. A multi-tenant building has a landlord, a property manager, a building engineer, fifteen tenants who each think their suite is the important one, janitorial at night, vendors at odd hours, and a parking gate that everybody blames for everything. We have been installing access control in Orange County buildings since 1984, and the multi-tenant jobs are where the planning matters more than the hardware.

This guide is the conversation we have with property managers before we quote anything. It covers who should control which doors, what move-in and move-out should look like, the elevator and parking pieces people underestimate, and how the money usually splits between landlord and tenant.

Base building vs. tenant suites: who controls what

Every decision in a multi-tenant building gets easier once you draw one line: base building doors versus suite doors.

Base building is everything the landlord operates: lobby and perimeter entrances, elevators, stairwell re-entry doors, parking gates, restroom corridors, the gym, the roof hatch, and the electrical, riser, and mechanical rooms. These doors live on the building's system, property management holds the admin rights, and every credential in the building is issued against this layer first.

Suite doors are the entries into each tenant's leased space. Here you have two workable models. Either the building system extends to the suite door and the tenant gets a partitioned admin login for their own people, or the tenant installs their own system behind your perimeter and you never think about their door again. Both are fine. The failure mode is the unplanned third model, where five tenants have five different standalone keypads, nobody documented any of them, and the building engineer carries a ring of mechanical override keys that may or may not still work.

We push most buildings toward the first model. One platform means one credential in each person's pocket that opens the garage, the lobby, the elevator, and their suite. Tenants get autonomy over their own space through their partition, and you keep a single building-wide view. The second model earns its place when a tenant has requirements beyond the building's, such as a medical suite with compliance obligations or a defense contractor with its own standards. In that case, control the path to their door and let them control the door.

Tenant onboarding: get the access levels right once

The move-in workflow is where a well-designed system pays for itself, because you do it over and over. Before the first tenant ever moves in, build access levels, not individual permissions. A tenant's access level bundles everything their people need: perimeter doors on a schedule, their elevator floor, the garage, and their suite. Onboarding a new employee then takes one step, assigning the person to the level, instead of touching eight doors one at a time.

Move-out day: revocation is the whole point

Ask any property manager what the old regime looked like when a tenant left. Chasing keys for two weeks, a stack of unreturned proximity cards, and a locksmith bill for rekeying the suite plus every common-area door the tenant had a key to. If a master key went missing, the bill got much worse. This is the workflow electronic access control was built to kill.

On a cloud system, move-out is a scheduled software event. On the surrender date, you disable the tenant's access levels and every credential tied to them dies at once: lobby, elevator floor, garage, gym, suite. It takes effect in minutes, it does not depend on physical badges coming back, and the event log will show you if anyone tried a dead credential afterward, which happens more often than you would expect.

Two cautions from experience. First, the mechanical layer still exists. Suite doors have key cylinders under the electronics, and if the departing tenant held keys, you still want the cylinder rekeyed. Our commercial locksmith side handles that as part of the same turnover visit. Second, do the revocation on the surrender date, not when someone gets around to it. We have audited buildings where tenants gone for a year still had working garage credentials because nobody owned the task. Put it in the move-out checklist next to the walkthrough.

After-hours entry and the lobby

During business hours, most buildings run an open or attended lobby. The access control question is really an after-hours question: at 6 p.m. the perimeter locks, and everything from then on is credentialed and logged.

The pieces that matter: a schedule that locks perimeter doors automatically, so it does not depend on a person remembering; a designated after-hours entrance, usually one lobby door, so nighttime traffic funnels past a camera instead of trickling through six doors; and door-position monitoring, so a propped door generates an alert instead of staying open until morning. If the building has an attended desk, give the desk a way to see door events and release the entrance for expected visitors. If it does not, a video intercom at the after-hours door covers deliveries and guests, and it pairs naturally with video surveillance at the lobby so an entry event and the footage of it can be matched when a question comes up.

Decide the holiday and weekend posture per tenant, in writing. Some tenants expect 24/7 access as a lease right. Others do not want their own employees inside on weekends. The system can do either, but only if someone made the decision.

Elevator access control: floor lockout basics

Elevators are the part of multi-tenant access control that surprises people, both in capability and in coordination required. The standard approach is floor lockout: the cab reaches every floor mechanically, but the buttons for controlled floors do not respond unless a valid credential is presented at the reader in the cab. Anyone can ride to the lobby. After hours, or around the clock for full-floor tenants, the upper floors only answer to their own people.

A credential can be mapped to specific floors, so the fourth-floor tenant's badge lights up floor four and nothing else. Buildings with destination dispatch systems move the credential check to the kiosk in the lobby, which assigns you a car based on who you are. Either way, the elevator effectively becomes another door in the same system, with the same instant revocation and the same event log.

The honest caveat: elevator integration is a three-party job between us, your elevator service company, and sometimes the elevator manufacturer, because the access system lands on the elevator controller's interface. Older traction elevators can need controller work before they can accept it. This is the line item with the widest cost range in the whole project and the longest lead time, so raise it in the first meeting. A building that skips elevator control can still get most of the value from stairwell and perimeter control, but retrofitting the elevators later costs more than doing it in the same project.

Parking garage and gates

Parking is the amenity tenants complain about most, so it deserves better than the fifteen-year-old clicker system most buildings still run. Bringing the garage onto the building platform means the same credential that opens the lobby opens the gate, a departed employee loses parking the same minute they lose the front door, and the log shows who entered the structure at 11 p.m.

The practical details: gates want long-range reading, so people are not leaning out of car windows to tap a card. That means Bluetooth mobile credentials read at distance, dedicated long-range readers, or license plate recognition, each with different costs and quirks. Count your allocations in the system too. If each tenant's lease grants a set number of stalls, issue exactly that many parking-enabled credentials per tenant and the software enforces what the lease says. And keep a plan for visitors and the food trucks, because a gate that handles employees perfectly and strands everyone else generates more calls than the clickers did.

Common-area doors: gym, roof, risers

The doors between the lobby and the suites are where buildings either apply judgment or waste money. Our short list for a typical Orange County office building:

• Fitness room and showers. Credentialed, on a schedule, with events logged. When something goes missing from a locker room, the first question is who was in there, and this door answers it. It also enforces the waiver-on-file rule, since only tenants who signed get the access level.
• Roof hatch or roof door. Controlled and alarmed. Your HVAC vendors need to get up there and nobody else does. This is also a liability door, and the log proving it stayed shut is worth more than the reader costs.
• Riser rooms, electrical, and telecom closets (MPOE). Controlled, with access limited to the building engineer and named vendors. Telecom risers are entered by a parade of carrier techs nobody at the building has met. A credentialed door with a per-visit access window beats the sticky note with the lockbox code.
• Stairwell re-entry doors. These carry fire code requirements on egress and re-entry that vary by building, so the locking scheme has to be designed with the fire marshal in mind, not copied from another property. Egress always works without a credential. That part is not negotiable anywhere.
• Janitorial and storage closets. Usually fine on the mechanical master key system. Not every door earns electronics, and a quote that puts a reader on every closet is a quote to question.

Who pays: landlord, tenant, or the TI budget

The money conversation follows the same base-building line. What we see in Orange County leases, with the usual caveat that your lease and your attorney govern:

• Base building system. Landlord capital. Lobby, elevators, parking, common areas, and the platform itself are building infrastructure, and their operating cost typically flows back through CAM or operating expenses like any other building system.
• Suite doors. Most often tenant improvement dollars. When the suite door joins the building system during a build-out, it rides the TI budget alongside the rest of the construction, and the hardware generally stays with the building as a leasehold improvement at move-out.
• Tenant-owned systems. The tenant pays, the tenant owns it, and the lease's alterations and restoration clauses decide whether it leaves with them or the door goes back to standard hardware at their cost.
• Software licensing. Cloud platforms carry per-door or per-reader recurring fees. Buildings usually carry the base building licensing in operating expenses and pass suite-door licensing to the tenant, but we have seen it structured both ways. The important thing is that somebody decided on purpose.

For actual numbers, per-door installed ranges and what moves them, use our Orange County access control cost guide. Multi-tenant buildings land at the same per-door math for standard openings, plus the elevator and gate line items that are always quoted from a site visit.

One dashboard across the portfolio

If you manage more than one property, the strongest argument for cloud access control is not any single feature. It is logging into one dashboard and seeing every building. Credentials, schedules, alerts, and event history for the whole portfolio in one place, with a new hire at your management company granted access to three buildings in one step. Holiday schedules get pushed to every property at once instead of being programmed on-site at each panel, which is exactly the task that used to slip.

The platforms we install most, ProdataKey first and Brivo and Verkada where they fit better, all handle multi-site management and partitioned tenant administration. They differ in pricing structure, integrations, and how the video story works, and we wrote up the honest differences in our PDK vs. Brivo vs. Verkada comparison. For a portfolio, weight two things heavily: how the platform handles many sites under one login, and whether the per-door recurring cost stays sane multiplied across two hundred doors.

Janitorial and vendor access windows

Night janitorial is the classic multi-tenant hole. The crew needs to reach every suite, they work when nobody is watching, staffing turns over, and in the key era that meant a cleaning company holding a master key, which is exactly as bad as it sounds. One lost master and the building faced rekeying every cylinder it opened.

The credentialed version: the janitorial company gets named credentials, one per person, not a shared fob for the crew. Their access level works during the contracted window, say 6 p.m. to 2 a.m. on weeknights, and is dead the rest of the time. When the company swaps a crew member, their old credential is disabled the day you are notified, and the contract should require that notification. The same pattern covers every recurring vendor: elevator techs, landscapers, the day porter, fire alarm inspectors. For one-off visits, issue a temporary mobile credential scoped to the door and the day, which beats both the escort nobody has time to provide and the propped-open door everybody actually uses.

The side benefit is verification. When a tenant reports their suite was not cleaned Tuesday, the log shows whether the crew badged in. Sometimes it defends the vendor, sometimes it ends the contract. Either way it ends the argument.

Audit trails settle disputes

Multi-tenant buildings generate disputes: a break-in claim in a suite, a laptop missing from a fitness room, a slip-and-fall in the garage with a contested timeline, a tenant insisting building staff entered their space. What you have in each case is an event log with a timestamp, a named credential, and a door. Paired with camera footage, it usually resolves the question in minutes, and insurers and attorneys treat exported logs as the kind of documentation that makes claims move.

Three habits make the log worth having when the day comes. Keep credentials personal, never shared, because a log entry for "Suite 210 fob 3" identifies nobody. Confirm your platform's retention window and pay for more if your leases or your insurer expect it, since some tiers default to a year. And export the relevant window as soon as an incident is reported rather than assuming it will be there in eight months.

Retrofitting an occupied building without tenant mutiny

Almost every multi-tenant project we do is a retrofit with tenants in place, and it is routine when sequenced properly. The parts tenants would notice, doors out of service and lobby work, get scheduled around them. Cabling runs above ceilings and through risers while every door keeps working on its existing hardware. Each opening is then cut over individually, out of service for an hour or two, early morning or evening for suite doors and off-hours for the lobby and elevators.

The credential transition matters more than the construction. Run the old and new systems in parallel for a short overlap where both credentials work, so the building never has a day when someone is locked out because their new badge had not arrived. Communicate three times: the project is coming, your credentials are here, the old ones die Friday. The buildings that skip the middle notice are the ones where move-in day generates a line at the management office. If you are replacing an existing system rather than starting from bare doors, our legacy migration guide covers what carries over and what does not, and the answer is more than most people expect: wiring, strikes, and power supplies usually survive, which is a meaningful chunk of the cost.

One more retrofit note: rated corridor doors and fire-rated openings constrain what hardware can go on them, and permits and fire marshal coordination are part of a legitimate quote in most Orange County cities. An installer who does not mention permits on a multi-tenant job is telling you something.

Where to start

Walk the building with the base-building-versus-suite line in mind and count the doors that actually matter: perimeter, elevators, parking, the common areas above, and the suite doors that will join the system. That list, plus your tenant count, is enough for a real conversation and a real number. We will do the walk with you, tell you which doors we would skip, and put the plan in writing. Start at get a quote or call us at the number below.