Upon trying to save a Tenant record in ConfigDB, the following error may appear in HEATSM 2016.1.1 and newer.
Exception message: Exception has been thrown by the target of an invocation., InnerException: Server was unable to process request. ---> Saas.WebUI.Services.AppWebServiceException: 500 Authorization failed...
This error is typical of an installation where the ConfigDB is being accessed from an unexpected URL. The URL being used to access the ConfigDB will also be used to call an IIS endpoint on the application server to kick off a reset of the tenant's cache. If the this endpoint is not authorized from the workstation or server where you are logged into ConfigDB, this error will appear.
One possible workaround is to RDP to the application server and then log into ConfigDB by going to http://localhost/heat.
If this does not allow access or you still cannot save then there may be other issues involving SSL in play. Typically these would best be addressed by setting up a FQDN, Certificate, SSL binding and DNS entry specifically for the Configuration Server (ConfigDB) however the details of these situations can vary from environment to environment.