# Tenant vs configuration set — decision matrix

Use when designing SES for multi-brand, multi-customer, or multi-BU email. **MREP** (Global Endpoints) solves **regional resilience**; **Tenants** solve **reputation isolation**.

| Criterion | Configuration set only | Tenant management |
|-----------|------------------------|-------------------|
| Primary goal | Tracking, IP pool assignment, event routing | Per-tenant reputation isolation and enforcement |
| Scale | Tens to low hundreds of streams | 10k default tenants (300k on request) |
| Reputation enforcement | Account-level pause affects all streams | Pause one tenant without affecting others |
| IAM scoping | `configuration-set` ARN in policy | `ses:TenantName` condition + resource ARNs |
| SMTP | `X-SES-CONFIGURATION-SET` header | `X-SES-TENANT` header (plus config set) |
| Suppression scope | Account (or tenant-level since June 2026) | Tenant-scoped bounce/complaint lists |
| EventBridge findings | Account-level | Tenant-level reputation findings |
| Operational overhead | Low | Medium — onboarding automation required |
| Best fit | Single brand, marketing vs transactional split | SaaS ESP, agency multi-brand, enterprise multi-BU |

## MREP compatibility

| Pattern | Supported | Notes |
|---------|-----------|-------|
| MREP + configuration sets | Yes | Pass `endpoint-id` and `configuration-set-name` |
| MREP + tenants | Yes | Pass `endpoint-id`, `tenant-name`, and config set |
| MREP replaces regional resources | **No** | Identities, config sets, quotas must exist in **both** regions |
| Tenants auto-replicate to secondary | **No** | Manual tenant + association setup in secondary |

## Recommendations

- **Single-brand enterprise, one app:** Configuration sets (transactional vs marketing). Skip Tenants unless separate BUs have independent reputation risk.
- **SaaS sending for customers:** Tenants from day one; configuration sets per tenant for tracking.
- **Internal platform team, custom SES portal:** Tenants if portal maps to customer/BU entities; otherwise config sets + IAM scoping may suffice below 50 streams.
- **MREP without Tenants:** Valid for HA transactional email (OTP, receipts) on a single brand.
- **Tenants without MREP:** Valid for deliverability isolation when regional HA is not required.

## When both

Global ESP or regulated multi-tenant SaaS with Tier-1 email SLA: **MREP + Tenants + dedicated IP pools per tenant tier**.