Skip to main content
This lesson explains multi-tenant environments in Microsoft Entra ID (formerly Azure AD). It’s optional for certification exams, but important for understanding how tenants are isolated, how administration is scoped, and how synchronization and collaboration work across tenants.
This topic is optional for the exam but useful for understanding how Microsoft Entra ID tenants operate independently.

​
What is a tenant?

A tenant in Microsoft Entra ID is a dedicated, isolated instance of the directory service. Each tenant represents an organization and contains users, groups, applications, policies, and settings that are scoped to that tenant. Although many tenants run on the same Azure infrastructure, they operate independently to preserve security and administrative boundaries.

​
Core principles of multi-tenant environments

The following principles explain how tenants remain separate and how that impacts administration, resources, and synchronization. These principles ensure secure isolation while enabling scenarios like B2B collaboration and multi-tenant SaaS applications.
A presentation slide titled "Multi-Tenant Environments" with four colorful rounded blocks. Each block shows an icon and label: Relationship, Resource Independence, Administration Independence, and Synchronization Independence.

​
Working with multiple tenants in the Azure portal

A single user account can be a member of multiple tenants. When you sign in to the Azure portal with your account, you can switch between tenants you have access to and manage resources or identities specific to each tenant. Keep in mind the portal UI evolves over time, so controls (like the tenant switcher) may appear in different places. To view or switch tenants:
  • Open the account or tenant menu in the portal (top-right) and check the list of tenants you belong to.
  • Select the tenant you want to manage—the portal will refresh to show that tenant’s subscriptions, resources, branding, and policies.
Your “home” tenant is usually created when you register with an email (including personal emails). Additional tenants appear when you are invited via B2B collaboration or when you join an organization. Because each tenant can have distinct branding, policies, and available resources, the portal experience can change when switching.
A screenshot of the Microsoft Azure portal showing a private dashboard titled "Prodigy Linux Prod" with spending and cost widgets that display "Failed to retrieve billing information. Please try again later." The left sidebar shows Azure service icons and the top bar includes a search field and user/menu controls.

​
Practical considerations and tips

  • Roles and access: If you need administrative access in another tenant, request the appropriate role assignment from an existing administrator in that tenant — roles don’t propagate across tenants automatically.
  • B2B collaboration: Invite external users from other tenants for collaboration. Invited users become guest accounts in the inviting tenant but still belong to their home tenant.
  • Synchronization: Use Azure AD Connect (or other identity providers) per tenant to control which on-premises objects synchronize to each tenant. See Microsoft’s Azure AD Connect overview for details: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/whatis-azure-ad-connect
  • Auditing and compliance: Treat each tenant as a separate security boundary when planning monitoring, compliance policies, or incident response.
Remember: Administrative roles, resource changes, and synchronization settings are tenant-scoped. Plan identity governance and access control per tenant to avoid unwanted cross-tenant impact.

​
Summary

  • Microsoft Entra ID tenants are independent across relationships, resources, administration, and synchronization.
  • Administrative privileges and synchronization configurations do not cross tenant boundaries unless explicitly configured.
  • You can belong to multiple tenants and switch between them in the Azure portal; the portal experience (branding, resources) may change per tenant.
This concludes the Administer Identity content. The next section will cover governance and compliance in Azure.

Watch Video