@mrvisser: I can't immediately find a test that verifies `includeExternal` when a tenant has been set up to be private. Do we have such a test?