Microsoft Entra tenant
What it is
A tenant is a dedicated, isolated instance of Microsoft Entra ID representing a single organization. It is the security boundary/container for that org’s identities (users, groups, apps) and its own configuration.
Why it exists
Because Azure is shared infrastructure, each org needs an isolated directory where its identities live and are managed. The tenant defines the trust and isolation boundary — identities, data and settings in one tenant are isolated from others.
Key ideas
- Tenant relationship — every Azure subscription is associated with (trusted by) one tenant; the tenant controls who can admin the subscription.
- Tenant vs subscription — the tenant is the identity/directory container; a subscription is the resource container (billing + RBAC). A single tenant can own many subscriptions.
- Multi-tenant — tenants can collaborate via B2B/B2C and cross-tenant access, but remain isolated by default.
- Accessed as a domain like
contoso.onmicrosoft.comor a custom domain you verify.
How it fits (diagram)
Exam notes
- One tenant, many subscriptions is the classic AZ-104 organizational model (e.g. a management group tree under one tenant).
- Distinct tenants can be treated as isolation boundaries when segments/trades need separation.
- Rebranded Azure AD → Microsoft Entra ID; “tenant” means the same directory.
Related
entraid · subscription · user-account · management-groups
📘 Source: Microsoft Learn — Tenant