Configuring Merlin for your Tenant
This page is for Tenant Administrators setting Merlin up for their Tenant. To find out what Merlin can do and how to talk to it, see the Merlin Overview page instead. Everything here that you can change yourself is in the Admin app.
Merlin settings for your Tenant
| Setting | What it decides | Where |
|---|---|---|
| Merlin chat | Whether the interactive Merlin chat appears for your users at all | Set by Panoramic Data on request |
| AI provider | Whether answers come from Panoramic Data's AI or from your own AI provider account | Admin app: Tenant, then Merlin AI |
| Data egress consent | Whether Magic Suite may send your data to a third-party AI provider at all | Admin app: Tenant, then Merlin AI |
| Connections | Which of your systems Merlin can look at, such as your ticketing system or Cisco Meraki | Admin app: Connections |
Turning the chat off removes only the interactive assistant. Magic Suite's other notifications still appear.
Merlin can look at your tickets and your Meraki networks only through a Connection. It is offered those abilities only when your Tenant has a Connection for the system, or you have a Personal Connection for it, and the Connection's last check did not find it invalid. A new Connection counts from your next message. When an assistant answers, only the Connections granted to it count. If you ask about a system with no usable Connection, Merlin says so and tells you a Connection can be added in the Admin app.
Your Merlin plan
Merlin is a subscription in its own right, alongside your other Magic Suite products, and every Tenant has one. To see yours, go to Tenant, then Subscriptions in the Admin app.
| Plan | Which AI answers | Can you use your own provider? |
|---|---|---|
| Merlin Free | Always Merlin's own model, on hardware Panoramic Data owns and operates. Nothing is sent to a third-party AI provider. | No |
| Merlin Pro | Your own provider, once you choose a Connection and give consent. Otherwise Panoramic Data's AI. | Yes |
| Merlin Enterprise | As Merlin Pro | Yes |
Merlin Free includes 1,000,000 tokens of Panoramic Data's AI each calendar month for the whole Tenant. Merlin Pro and Merlin Enterprise are not limited by it. The Merlin Free monthly allowance page explains what counts and what happens when it runs out.
Every Tenant gets Merlin Free automatically, so nobody is left without Merlin because a subscription was missed. That automatic step never downgrades a paid plan.
A Merlin Pro or Merlin Enterprise subscription that starts on the first of next month already counts for the rest of this month, so a new plan takes effect as soon as it is added rather than on its start date.
Where your data goes by default
By default, Merlin runs on hardware Panoramic Data owns and operates. Your questions, and anything Merlin's tools read to answer them, stay within that infrastructure and are not sent to a third-party AI provider.
That stays true until you give data egress consent. Consent is the one switch that controls this. Without it, nothing leaves our infrastructure, whatever your plan, whether or not you have chosen a Connection, and whether or not Panoramic Data supplies a provider. A new Magic Suite version does not change it.
Using your own AI provider
On Merlin Pro and Merlin Enterprise, Merlin can use your own AI provider account instead of Panoramic Data's AI, through an OpenAI or Anthropic (Claude) Connection, and you pay that provider directly. This is sometimes called bring your own tokens.
Why you might
- You already have a contract or committed spend with a provider
- Your organisation requires AI processing under its own provider agreement
- You want a model that Panoramic Data's AI does not offer
- You want your AI spending itemised on your provider's bill rather than ours
Why you might not
- It sends your data to a third party, so it should be a deliberate decision
- You become responsible for the provider account, its spending limits and its rate limits
- Magic Suite cannot cap what your provider charges you, so set a limit at the provider
Setting it up
- In the Admin app, go to Tenant, then Subscriptions, and check that you are on Merlin Pro or Merlin Enterprise. On Merlin Free, the Merlin AI page says so and lists your AI provider Connections instead of offering a choice
- Go to Connections and create an OpenAI or Anthropic (Claude) Connection for your Tenant. The OpenAI Connections and Anthropic (Claude) Connections help pages explain how. It must be a Tenant Connection, not a Personal Connection. In its Configuration, name the model. For OpenAI's gpt-5.6 and gpt-6 models, also set "ReasoningEffort": "none", as the OpenAI Connections help page explains
- Go to Tenant, then Merlin AI, and choose your Connection under AI Provider. Only Tenant Connections of type OpenAI or Anthropic (Claude) are listed. The Requirements section shows which of the plan, a chosen Connection and consent are already in place, and the page says which provider will answer, and why
- Under Data Egress Consent, read the consent statement, which lists what Merlin sends and whose agreement governs it, and tick the box below it. Until you do, Merlin keeps using Panoramic Data's AI
- Save
- Ask Merlin something it has to look up, such as which Connections your Tenant has. The answer should end with a line naming your model, as described under Which provider answered below
Note: choosing a Connection without giving consent changes nothing, so nothing is sent to a third party by accident.
Changing your mind
To stop using your own provider, go to Tenant, then Merlin AI, choose the default, Use Panoramic Data's AI, and Save. Your consent is kept, because it also covers the provider Panoramic Data supplies, so Merlin uses that provider where there is one. Switching from one of your Connections to another keeps your consent too.
To withdraw consent, untick the box under Data Egress Consent and Save. Merlin then uses its own model, on hardware Panoramic Data owns and operates, and nothing more is sent to a third party.
If the Connection is deleted, Merlin goes back to Panoramic Data's AI by itself rather than stopping.
If Panoramic Data supplies a provider
Panoramic Data may also make a third-party AI provider available to Merlin Pro and Merlin Enterprise Tenants, holding the agreement with that provider and paying for what Merlin uses. Your data then goes to that provider under Panoramic Data's agreement with it, not one of yours, so how long it keeps the data, and whether it uses it to train models, is set by that agreement. It is still a third party, so it is only ever used for a Tenant that has given data egress consent, and your own Connection always comes first.
The one consent statement covers both: the provider you choose, under your own agreement with it, and the provider Panoramic Data supplies, under Panoramic Data's agreement.
You do not need a Connection of your own to use it. Go to Tenant, then Merlin AI, leave AI Provider on Use Panoramic Data's AI, read the statement under Data Egress Consent, tick the box below it, and Save. The page says which provider will answer, and why.
Note: if your Tenant gave consent before the statement covered Panoramic Data's provider, the Merlin AI page says so. That consent still covers your own provider, but Merlin will not use the provider Panoramic Data supplies until you select Consent to the Current Wording, which records your consent straight away.
When Merlin will not use your provider
If your setup cannot be used, Merlin answers with Panoramic Data's AI rather than failing. Magic Suite records the reason in its logs, so Panoramic Data support can tell you why.
| Situation | What to do |
|---|---|
| No consent given | Tick the consent box on the Merlin AI page, and Save |
| Your plan is Merlin Free | Merlin Free always uses Merlin's own model. A Tenant Admin can buy Merlin Pro by card from Tenant, then Subscriptions, in the Admin app. |
| The Connection was deleted | Create a new Connection and choose it on the Merlin AI page |
| The Connection is missing its URL, key or model | Edit the Connection and fill them in |
| Answers arrive but are vague or not based on your data | The model may not be able to call tools. See Tool calling below. |
A problem at your provider is different. If your provider rejects a request, for example because the key has been revoked or the account has run out of credit, Merlin shows an error instead of answering. Open the Connection in the Admin app and use Test Connection to see why.
These are the ones Merlin most often shows:
| What Merlin shows | Usual cause |
|---|---|
| Function tools with reasoning_effort are not supported (status code 400) | An OpenAI gpt-5.6 or gpt-6 model needs "ReasoningEffort": "none" in the Connection's Configuration |
| You have no credits remaining (status code 429) | Your provider account has run out of credit. Add credit at the provider, or use another key |
Merlin never repeats your provider's own message, which can carry your account details, and says in its own words what went wrong instead:
| What Merlin says | Usual cause |
|---|---|
| Your organisation's own AI provider did not accept its key | The key has been revoked or mistyped. Put a current key on the Connection |
| Your organisation's own AI provider does not offer the model you chose | The Connection names a model the provider account cannot use |
| Your organisation's own AI provider rejected the request as Merlin sent it | Often an OpenAI gpt-5.6 or gpt-6 model, which needs "ReasoningEffort": "none" in the Connection's Configuration |
| Your organisation's own AI provider says its account is out of credit | Add credit at the provider, or use another key |
| Your organisation's own AI provider is limiting how many requests it will accept | Your account's rate limit at the provider. Wait a minute and try again |
| Your organisation's own AI provider had a problem of its own, or did not reply in time | An outage or a slow response at the provider. Try again shortly, and check the provider's status page if it continues |
| Something went wrong, with a reference to quote | Anything else. Contact Panoramic Data support and quote the reference, which lets us find the details |
Which provider answered
When your own provider answers, Merlin ends the answer with a line saying so, such as Answered by claude-sonnet-4-6 on your organisation's own AI provider. That line is how you tell a working setup from one that has fallen back. The fall-backs above are silent by design, so that a misconfiguration costs you your chosen model rather than an answer.
No such line means Panoramic Data's AI answered.
Tool calling
Merlin answers most useful questions by calling tools that read your Magic Suite data. A model or service that cannot call tools still answers, fluently and confidently, but from the conversation alone, with nothing behind the answer.
Magic Suite checks this when you create the Connection, when you change its URL, key or model, and whenever you use Test Connection. The AI Tool Calling column on the Connections page shows the result: Supported, Not supported, or Not checked. When it says Not supported, Merlin also says so on each answer, rather than leaving you to notice. When it says Not checked, use Test Connection.
Check this before relying on a gateway, a proxy or a self-hosted server rather than the provider itself. The symptom is answers that sound right but are not based on your data.
Which models Merlin can use
Merlin answers with the models Panoramic Data serves. A few frontier models cost too much for us to serve on our own provider credentials: at present, Claude Fable 5.1 and Claude Mythos 5.1. They are available only when your organisation uses its own AI provider credentials, through an Anthropic (Claude) Connection chosen on the Merlin AI page with data egress consent. Your provider then bills you directly for what they use.
Without your own Connection, an assistant that asks for one of these models is answered by Merlin's own model, and a note says why. The Merlin models page lists which models are available on which credentials.
What it costs
When Merlin uses your own provider, the provider bills you directly and Panoramic Data does not charge you for that use. Set a spending limit at the provider, because Magic Suite cannot enforce one for you.
When Merlin uses Panoramic Data's AI, use is covered by your subscription. On Merlin Free that is up to 1,000,000 tokens each calendar month, after which Merlin stops answering until the allowance resets at 00:00 UTC on the 1st. Tokens answered by your own provider never count towards that allowance.
Questions to settle before you switch
- Does your organisation's data protection position allow this provider to process your data?
- Who owns the provider account, and what happens when that person leaves?
- What spending limit is set, and who is told when it is reached?
- Who will notice if Merlin quietly falls back to Panoramic Data's AI?
Merlin and Cisco Meraki
Merlin reads your live Meraki data through Cisco's own hosted Meraki MCP service, using the API key on your Tenant's Meraki Connection. Merlin only reads: it can never change a Meraki network on its own. When you click Test Connection on a Meraki Connection in the Admin app, Magic Suite also checks that the Meraki MCP service accepts the Connection's API key, and the Connection shows as invalid, with the reason, if it does not. A Connection that is invalid is not offered to Merlin.
Only Cisco's hosted service is supported. You cannot point Merlin at an MCP server of your own.
If the API key can see more than one Meraki organisation, set OrganizationId in the Connection's Configuration, as the Meraki Connections page explains. Until you do, Merlin refuses Meraki questions.
Automatic investigation of Jira tickets
Merlin can investigate new Jira tickets for you without being asked, and post what it finds as a comment on the ticket. It is off unless you switch it on for a Jira Connection. See the Jira Connections page for how to do so.
- The comment is labelled in its first line as an automatic Merlin analysis, so nobody mistakes it for a person's reply.
- Merlin reads your Meraki data (and your LogicMonitor alerts, if you have a LogicMonitor Connection). It never changes anything.
- Each ticket is investigated once for each version of its key, title and description. Editing the ticket makes it eligible again.
- It works to the same limits on rounds of queries, tokens and time as chat, and is billed like chat.
- Each Jira Connection has a daily limit on the tickets it will investigate, set by its
DailyCap.
Limits on automatic use
Reports that ask Merlin a question with the [Meraki.Analysis:] macro, and AlertMagic rules that call am_merakiEvidence, each have a daily limit for your Tenant, because every question costs model time and nobody is watching when a schedule or alert triggers one. When a limit is reached, a report fails with a message saying so, and an alert is assessed without Merlin's evidence. Panoramic Data sets the limits; ask support if yours needs to change.
- Report questions: 50 a day unless set otherwise.
- Alert evidence requests: 200 a day unless set otherwise.
Note: the [Meraki.Analysis:] macro can only be run by a Tenant Administrator. A schedule owned by anyone else fails with a message saying so.
