Microsoft Tenants

What is an Azure tenant (Microsoft Entra ID tenant) — and what is it used for?

tl;dr
An Azure tenant — now called a Microsoft Entra ID tenant — is a dedicated, isolated instance of Microsoft’s identity service that represents an organization’s identity and access boundary. It’s the directory that stores users, groups, applications and their credentials, service principals, roles, and policies used to authenticate and authorize access to resources and apps.

Why the distinction matters
People often confuse “tenant” with “subscription.” They are different:

• Tenant (Microsoft Entra ID): an identity and access container. It owns the directory objects (users, groups, app registrations, service principals, directory roles, conditional access policies).
• Subscription: a billing and resource container for Azure resources (VMs, storage, databases). A subscription is associated with a tenant (one tenant), but a tenant can contain many subscriptions and management groups. In short: tenant = identity; subscription = resources and billing.

What an Entra ID tenant is used for (practical overview)

• Identity and authentication
• Manage user accounts, passwords, multifactor authentication (MFA), single sign-on (SSO), and passwordless sign-in across Microsoft and third-party apps.
• App registration and authorization
• Register applications, create service principals, and issue tokens for apps and APIs. This is how applications are granted permissions and obtain tokens to call Microsoft Graph or Azure management APIs.
• Access control
• Assign Azure RBAC and directory (Entra) roles to users, groups, and service principals to govern who can access resources and what actions they can perform.
• External identities and collaboration
• Invite partner users (B2B), provide customer identity flows (B2C), or support multi-tenant SaaS applications that let users from other Entra tenants sign in.
• Governance and compliance
• Attach subscriptions to the tenant’s management groups, apply policies and compliance controls across your organization, and centralize identity governance (for example, Conditional Access and identity lifecycle controls).

Trends and the bigger picture

• Branding: Azure Active Directory has been rebranded into Microsoft Entra ID (part of the Entra family). The rename doesn’t change the underlying tenant semantics, but highlights identity as a broader product family.
• Identity-first Zero Trust: Entra ID is increasingly the policy decision point for Zero Trust — evaluating risk signals, applying Conditional Access and enforcing least privilege.
• SaaS multi-tenant patterns: Microsoft has published more guidance and reference architectures for secure multi-tenant identity and tenant-scoped configuration.

Common challenges and best practices

• Tenant sprawl and governance
  • Problem: unmanaged extra tenants make centralized governance hard.
    • Best practice: maintain a clear subscription-to-tenant mapping, use management groups and policies, and minimize unnecessary tenants.
• Secure app credentials
  • Problem: long-lived client secrets leaking leads to compromise.
    • Best practice: prefer managed identities and certificates over client secrets in production, rotate credentials, and minimize permissions.
• Problem: multi-tenant app design affects consent, provisioning, and data isolation.
  • Best practice: decide early between single-tenant vs multi-tenant approach and design authentication/authorization flows and provisioning patterns accordingly.
• Principle of least privilege
  • Assign roles with minimal necessary permissions and use group-based or role-based assignments rather than granting broad directory admin roles.

How to find your tenant ID

• Azure/Entra admin center: Microsoft Entra (or Azure Active Directory) > Properties (or Overview) shows the Tenant ID (GUID).
• Azure CLI:
• az account show –query tenantId -o tsv
• PowerShell (Az module):
• Get-AzTenant | Select-Object TenantId, Domain
  These values are used in code and configuration (for example, building token endpoints or constructing credentials).

When to create a new tenant

• You typically create a new tenant for a distinct organization or when you need a fully isolated identity boundary (separate security/policy scopes, compliance reasons, or entirely separate administrative domains). Avoid creating tenants just to work around permissions or billing; in many cases management groups, subscriptions, and RBAC can provide the needed separation.

Note: The initial draft of this post was written by BlogWriter and then edited by Jesse Liberty
Illustrations by Copilot. Caution: LLMs make mistakes; this post is offered as is.