A ministry with reach of its own can carry others. A second-tier customer is a distinct ministry — its own website, its own admin, its own domain, its own brand — living inside the parent’s project and sharing its infrastructure, its billing and its payment setup.
Open the parent tenant’s screen.
A second-tier customer is created from the parent, never from the Estate.
Start a new tenant from there.
The form says "New second-tier customer of" the parent, and it inherits the parent’s project, region and payment setup rather than asking again.
Decide how they are billed.
Blank means the parent pays. Give their own billing account to bill them directly.
A second-tier customer is NOT a section of the parent’s website. It is a separate ministry that happens to be hosted inside another one’s project, and its people cannot see the parent’s records.