How does multi-tenant work and is it secure? Also does single tenant with API permissions (email, openid, profile and User.Read) work same as multi tenant?

Question

How does multi-tenant app registration work and is it secure? Also does single tenant with API permissions (email, openid, profile and User.Read) work same as multi tenant? How are these features different from each other and which is more secure?

Answer 1

Hi @Swetalina Panda ,

A multi-tenant application allows different Azure AD tenant to use your application by creating passwordless trusts between the tenants. In this design, multiple tenants share the same physical instance of the app.

Whereas in a single-tenant architecture, you have to spin up new instances of the app within the tenant.

A single-tenant application can only be accessed by users with accounts in the same tenant as the application registration. As for security, anything serving more customers has a risk of being less secure, but those users will not be able to access your other data. The security is dependent on your own infrastructure and how you set up the application, which is really the case in either setup. You can use role-based access control, access policies, MFA, Conditional Access, and other protections to secure your app.

Let me know if this helps at all.

Resources:
Multi-Tenant Identity
How to convert an app to be multi-tenant

[4]: https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-convert-app-to-be-multi-tenant [6]: https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app