diff --git a/discovery/openstack/instance.go b/discovery/openstack/instance.go
index 8af90f6cb..9094836a4 100644
--- a/discovery/openstack/instance.go
+++ b/discovery/openstack/instance.go
@@ -27,7 +27,6 @@ import (
 	"github.com/gophercloud/gophercloud/openstack/compute/v2/servers"
 	"github.com/gophercloud/gophercloud/pagination"
 	"github.com/prometheus/common/model"
-
 	"github.com/prometheus/prometheus/discovery/targetgroup"
 	"github.com/prometheus/prometheus/util/strutil"
 )
@@ -46,22 +45,23 @@ const (
 
 // InstanceDiscovery discovers OpenStack instances.
 type InstanceDiscovery struct {
-	provider *gophercloud.ProviderClient
-	authOpts *gophercloud.AuthOptions
-	region   string
-	interval time.Duration
-	logger   log.Logger
-	port     int
+	provider   *gophercloud.ProviderClient
+	authOpts   *gophercloud.AuthOptions
+	region     string
+	interval   time.Duration
+	logger     log.Logger
+	port       int
+	allTenants bool
 }
 
 // NewInstanceDiscovery returns a new instance discovery.
 func NewInstanceDiscovery(provider *gophercloud.ProviderClient, opts *gophercloud.AuthOptions,
-	interval time.Duration, port int, region string, l log.Logger) *InstanceDiscovery {
+	interval time.Duration, port int, region string, allTenants bool, l log.Logger) *InstanceDiscovery {
 	if l == nil {
 		l = log.NewNopLogger()
 	}
 	return &InstanceDiscovery{provider: provider, authOpts: opts,
-		region: region, interval: interval, port: port, logger: l}
+		region: region, interval: interval, port: port, allTenants: allTenants, logger: l}
 }
 
 // Run implements the Discoverer interface.
@@ -153,7 +153,9 @@ func (i *InstanceDiscovery) refresh() (*targetgroup.Group, error) {
 
 	// OpenStack API reference
 	// https://developer.openstack.org/api-ref/compute/#list-servers
-	opts := servers.ListOpts{}
+	opts := servers.ListOpts{
+		AllTenants: i.allTenants,
+	}
 	pager := servers.List(client, opts)
 	tg := &targetgroup.Group{
 		Source: fmt.Sprintf("OS_" + i.region),
diff --git a/discovery/openstack/instance_test.go b/discovery/openstack/instance_test.go
index 8ee870a19..43879a8fb 100644
--- a/discovery/openstack/instance_test.go
+++ b/discovery/openstack/instance_test.go
@@ -48,6 +48,7 @@ func (s *OpenstackSDInstanceTestSuite) openstackAuthSuccess() (Discovery, error)
 		DomainName:       "12345",
 		Region:           "RegionOne",
 		Role:             "instance",
+		AllTenants:       true,
 	}
 	return NewDiscovery(&conf, nil)
 }
diff --git a/discovery/openstack/openstack.go b/discovery/openstack/openstack.go
index b248aaed8..f6146ee4c 100644
--- a/discovery/openstack/openstack.go
+++ b/discovery/openstack/openstack.go
@@ -27,7 +27,6 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	config_util "github.com/prometheus/common/config"
 	"github.com/prometheus/common/model"
-
 	"github.com/prometheus/prometheus/discovery/targetgroup"
 )
 
@@ -63,6 +62,7 @@ type SDConfig struct {
 	Region           string                `yaml:"region"`
 	RefreshInterval  model.Duration        `yaml:"refresh_interval,omitempty"`
 	Port             int                   `yaml:"port"`
+	AllTenants       bool                  `yaml:"all_tenants,omitempty"`
 	TLSConfig        config_util.TLSConfig `yaml:"tls_config,omitempty"`
 }
 
@@ -168,7 +168,7 @@ func NewDiscovery(conf *SDConfig, l log.Logger) (Discovery, error) {
 		return hypervisor, nil
 	case OpenStackRoleInstance:
 		instance := NewInstanceDiscovery(client, &opts,
-			time.Duration(conf.RefreshInterval), conf.Port, conf.Region, l)
+			time.Duration(conf.RefreshInterval), conf.Port, conf.Region, conf.AllTenants, l)
 		return instance, nil
 	default:
 		return nil, errors.New("unknown OpenStack discovery role")
diff --git a/docs/configuration/configuration.md b/docs/configuration/configuration.md
index f4456d09a..caf54fd76 100644
--- a/docs/configuration/configuration.md
+++ b/docs/configuration/configuration.md
@@ -531,6 +531,10 @@ region: <string>
 [ project_name: <string> ]
 [ project_id: <string> ]
 
+# Whether the service discovery should list all instances for all projects.
+# It is only relevant for the 'instance' role and usually requires admin permissions.
+[ all_tenants: <boolean> | default: false ]
+
 # Refresh interval to re-read the instance list.
 [ refresh_interval: <duration> | default = 60s ]