Azure ad B2C + multi tenancy

wode 1 Reputation point
2021-07-25T19:05:16.023+00:00

Hi all,

Some context:
I'm looking at implementing a Multi-tenant SaaS application using a SPA and Spring Boot backend, running on Azure App Service and using Azure AD B2C for identity management.

I've been going through the documentation and forum questions for a while now, but I'm starting to lose the overview a bit of what is possible and how it is possible.
More specifically, I'm stuck with the following questions to decide how best to implement this:

  • What would be the best strategy, using these Azure services, to implement multi-tenancy on the application level? A separate subdomain per tenant, or would it be possible to just host on e.g. app.mydomain.com and implement some other mechanism to separate the tenants?
  • Have I read it correctly: if azure ad b2c is used in multi-tenant mode, any tenant can use your application? Meaning, you'll need to filter out, e.g. based on tenant ID's in your app code yourself, which tenants are allowed and which are not?
  • Does Azure ad B2C multi-tenancy also allow for delegating authentication to a customer identity system? E.g. tenant A uses accounts locally inside azure ad B2C, tenant B delegates to their own identity management system using SAML, tenant C delegates to their own identity management system using OpenID Connect, ...?
  • Do I have some option to inspect the token and distinguish the tenant from the token sent in every request, e.g. the tenant issuer or any other token parameter? (taking into account my previous question too: if b2c supports this, that one tenant comes in over openid connect, the other one over saml, ...)
  • When using accounts stored in Azure AD B2C locally, can I also spread these out over multiple tenants inside B2C? or do they need to all be in one tenant and do I need to separate them e.g. using groups in this one tenant?
  • Is there a limitation on number of tenants which can be configured in Azure AD B2C?

Thanks in advance for any clarification or insight you can provide me!

Azure
Azure
A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.
936 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,436 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Marius Rochon 21 Reputation points Microsoft Employee
    2022-05-28T00:06:09.437+00:00

    Have a look at this sample.

    0 comments