A representation of network resources and relationships among the network resources is established. The network resources include network resources of a tenant and network resources of a plurality of clouds. Input specifying at least one network resource of the tenant, at least one network resource of each of two of the plurality of clouds, and an action directed to the specified network resources is received in the representation. A multi-cloud extension is configured in accordance with the input. The multi-cloud extension extends to network resources of the tenant and the plurality of clouds, and is isolated from network resources of other tenants.