[midPoint] Org structure visibility

[Michalis Siochos]

Hi All,

I'm trying to achieve something really straightforward with MidPoint 3.4.1
I would like an OU Manager to be able to see the org structure but only 
the OU(s) or subtree(s) he's managing.

I've been following this story: 
https://evolveum.com/blog/midpoint-goes-multitenant/

However, when I add the following authorizations, the manager gets full 
view of the org structure
<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#orgStruct</action>
<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#orgTree</action>

I have tried tenant orgs but no luck.

It seems that I miss something. Could you please advise?

Thanks!
Michalis