Cloud VMS without the Ubiquiti hardware lock.

"MSP multi-tenant console" is the integrator-side dashboard that lets one installer (or one MSP technician) sign in once and manage every end customer they look after - separate, walled-off video estates, separate billing, separate user lists - from a single pane. Think of it as the difference between an accountant logging in to a different Xero account for every client (one customer per session, switch context to move) versus logging in once to the accountant's firm-level dashboard that lists every client and lets the accountant pivot between them with one click. The "multi-tenant" part means each end customer's data, users and footage are kept logically separate; the "MSP" part means the integrator gets a layer above all of those tenants.

This is the largest functional gap with UniFi Protect for installers running more than a handful of customer sites. Ubiquiti's March 2026 "Site Manager" + "Fabrics" feature landed end-customer multi-site (one customer with several buildings), but the integrator still has to sign in to a separate ui.com account per customer. Third-party hosting platforms (HostiFi, UniHosted) layer a multi-tenant console over Ubiquiti consoles, but neither is a Ubiquiti product and both add another vendor (and another bill) to the stack.

TetherX ships an integrator-side multi-customer console as a first-party feature - one sign-in for the integrator, every end-customer estate visible inside it, channel-only billing through the installer, and the customer relationship and recurring revenue staying with the installer rather than the platform vendor. For an installer with five or more end customers, the absence of this layer in UniFi Protect is the operational tax.

The honest answer from the field (r/Ubiquiti, May 2026, "Is Ubiquiti Protect viable for large enterprise CCTV deployments?" - 80+ locations, 40-500 cameras per site, evaluating off Genetec + CCURE + Axis):

Connectivity. Per Ubiquiti's own Site Manager documentation a "Direct Connection automatically activates when accessing a site via Site Manager while connected to the same local network." Translation: same LAN gets a direct connection, remote viewing across sites goes through a ui.com brokered relay. No port forwarding required at the integrator end (good), but live-view latency and bandwidth on the cross-site view depend on Ubiquiti's relay path, not on a customer-controlled link.

"Show me every front door across every site" workflow. Not really. Site Manager + Fabrics federates sites at the navigation level, but there is no tag-based cross-site search ("show all cameras tagged front_door across all 80 sites in one grid"). Field report on the live view at scale, JamesAtWork85 verbatim: "Finding and organizing cameras in the live view grid is somewhat annoying at the 60 or so feeds we're at. Would be nice to be able to add a bit of structure to it." For a video wall feeding many cameras, slynas verbatim: "I'd be interested to see how you'd feed an entire wall of screens with protect, on a scalable level." The dedicated video-wall renderer at SOC scale is the gap, not the viewing surface.

ONVIF cameras (i.e. anything not Ubiquiti). Leading-Call9686, 30 large sites with 100-200+ cameras per site, verbatim: "if you are using Unifi cameras primarily, then it works great. But if you are trying to use ONVIF cameras, then you will run into issues... At this point I can't recommend any deployment that uses a majority of ONVIF cameras if you want minimal issues over time." Sala91: "ONVIF support is very hit and miss. Some cameras will just go to reboot hell with unify onvif protocol. Unifi own cameras however have been nothing but perfection in terms of reliability." Changing resolution / frame rate on an ONVIF camera requires fully removing and re-adding it; zero intelligent error reporting on ONVIF failures.

Footage export and chain of custody. Artentus: "If you export footage you are downloading MP4 files to your computer... if you have any special legal requirements it's not happening on Protect." No standalone-player export with integrity verification.

Field verdict on enterprise readiness. Sala91, after running an enterprise eval: "current trend shows them competent in about 5 years for big enterprise. Today it's probably perfect for SOHO, fits most SIMPLE deployments of enterprise and some more complex with help of MSP." Same thread, multiple commenters: future features (LTS branches, expanded continuous archiving, multi-site video wall) "with Ubi this could mean in two months or in five years." Translation: Site Manager / Fabrics is a real improvement on per-console isolation, but it is not the Genetec-class multi-site experience a 30+ site enterprise will recognise as "production-ready" today.

Ubiquiti pays the relay POP egress out of their AWS bill - and they keep it survivable by silently capping every off-LAN stream to the substream, not by capping you in writing.

The relay infrastructure is Ubiquiti-operated. cloudaccess.svc.ubnt.com resolves to ~2,970 IPs on Amazon CloudFront, UDM Pro debug logs put the control plane in AWS us-west-2 on AWS IoT topics, and the data plane is whatever CloudFront POP is closest to the viewer. CloudFront egress lists at roughly USD $80-$120 per TB at retail tiers. Naively, "10 sites x 8 cameras x 4 Mbps x 24/7" works out to ~10 TB per day of relay egress per customer, which would run a low-five-figures USD monthly AWS bill per heavy user. That is not what's happening - and there are three reasons why.

1. STUN-brokered P2P first, relay only as a fallback. The NVR holds an outbound socket to AWS; when a viewer opens a camera, AWS introduces the two endpoints and the media flows peer-to-peer over a UDP hole-punch. Ubiquiti pays the signalling cost (cheap) but not the media bytes (expensive). Users posting their firewall logs on r/Ubiquiti regularly see the NVR start uploading to a residential IP the instant they open the Protect app - that's the hole-punch in action. The relay only carries the media bytes when symmetric NAT or strict outbound firewalls defeat STUN, which is most enterprise networks but very few homes.

2. The substream cap is the bandwidth ceiling. When the path does fall back to the relay, Ubiquiti forces the off-LAN viewer onto the camera's H.264 "preview" substream rather than the main archive bitstream. The in-product banner says it in plain English: "A local connection helps reduce latency and maximize resolution during your viewing sessions." A substream is typically 480p-720p at 500 Kbps - 1 Mbps; the archive stream is 4-8 Mbps. So the "10 sites x 24/7" workload is closer to 10 x 8 x 0.5 Mbps = ~40 Mbps of relay throughput, not the headline 320 Mbps. At sub-$1 per camera per month in CloudFront egress, that's economically sustainable. Ubiquiti never has to publish a byte quota because the codec choice does the rationing for them.

3. The ToS catch-all backstops the maths. Ubiquiti's May 2024 Terms of Service reserve the right to "terminate or suspend your access to or right to use all or part of the services without notice... if Ubiquiti determines, in its sole and absolute discretion, that you... have engaged in any conduct otherwise harmful to the interests of Ubiquiti." There is no published "fair use" byte ceiling, no MB/GB language, no per-account quota - just a unilateral kill option for any account whose relay traffic becomes unprofitable. No public IPVM, Reddit, or community.ui.com thread surfaces a confirmed throttling or cut-off event, which suggests the substream cap is effective enough that few consumers ever hit the wall.

4. Client-side caps further bound the relay. Vantage Point (the only first-party multi-NVR SOC tool) caps at 5 NVRs per workspace. Multi-view caps at 16 streams in the iOS app and 26 streams on web/Android. So even a 7,000-site bank with 100 SOC operators is structurally limited to 100 x ~20 active streams x ~500 Kbps = ~1 Gbps of relay throughput, not the headline 7,000 x 24/7 number. And that customer would not be on Cloud Access anyway - the named integrator population running Protect at >1,000-camera control-room scale has publicly moved to a different VMS for exactly this workload - u/corsalove, a Ubiquiti installer himself, says outright on r/UnifiProtect that Protect is not the correct software for a 1,000+ camera control room and his team runs a different VMS for the monitoring layer.

Where this leaves the SOC / multi-site buyer. The "no fees, ever" claim is technically true: Ubiquiti is not invoicing the customer for the relay. But the off-LAN viewing experience that comes with it is fundamentally a low-bitrate preview, not the recording; the only documented multi-NVR SOC tool caps at 5 NVRs; and the service is governed by a unilateral kill clause rather than a contracted bandwidth commitment. There is zero published IPVM coverage of a named Protect SOC deployment and zero Ubiquiti case study of a named ARC customer - the absence is itself the answer. Verkada, Rhombus and Eagle Eye take the opposite shape: camera or bridge uploads continuously to the vendor cloud, cloud is the canonical source for every viewer, multi-viewer fan-out is paid for once on the site-to-cloud upload, archive-quality is the only quality, and the bandwidth cost is explicit on the camera licence. TetherX sits in between: a TetherBox at the site brokers, and the customer chooses per camera which streams stay LAN-only (zero ongoing cost), which become cloud-resident at archive quality (priced explicitly per camera), and which use the cloud only as failover. No silent quality cap, no client-side keep-alive cliff, no sole-discretion suspension. Choosing the architecture is the point.