What to know the difference between a tenant, directory and a domain in azure? what is the difference between a tenant and a directory?

@Anonymous Thank you for reaching out to us, As I understand you want to understand the concepts of tenant, directory and domain within Azure. In Azure, a tenant, directory, and domain are related but distinct concepts. Here's a brief explanation of each: Tenant : A tenant is a dedicated and isolated instance of the Azure Active Directory (Azure AD)/Microsoft Entra ID service that an organization receives when it signs up for a Microsoft cloud service such as Azure, Microsoft 365, or Dynamics 365. Each tenant has its own identity and access management scope, and is distinct and separate from other tenants. A tenant is also associated with a unique tenant ID , which is a globally unique identifier (GUID) that identifies the tenant in Azure AD. Directory : A directory is a container for objects such as users, groups, and applications, and is used to manage access to resources in Azure. A directory is also associated with a unique directory ID, which is a GUID that identifies the directory in Azure AD. Domain : A domain is a name that identifies a group of resources on the internet, such as a website or an email server. In Azure, a domain is used to verify ownership of a custom domain name and to create user names and email addresses for users in a tenant. A domain can be associated with one or more tenants, and each tenant can have multiple domains. The main difference between a tenant and a directory is that a tenant is a dedicated and isolated instance of Azure AD/Entra ID, while a directory is a container for objects such as users, groups, and applications. A tenant can contain one or more directories, and each directory can contain one or more tenants. In summary, a tenant is a dedicated and isolated instance of Azure AD that an organization receives when it signs up for a Microsoft cloud service, while a directory is a container for objects such as users, groups, and applications, and is used to manage access to resources in Azure. A domain is a name that identifies a group of resources on the internet, and is used to verify ownership of a custom domain name and to create user names and email addresses for users in a tenant. Reference: https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-create-new-tenant https://techcommunity.microsoft.com/t5/azure/relationship-between-azure-active-directory-and-directory-tenant/m-p/1605314 similar discussion can be read here. Let me know if you have any further questions, feel free to post back. Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

Help me to understand the concepts of tenant, directory and domain.

Accepted answer

Givary-MSFT 32,311 Reputation points Microsoft Employee

2023-12-06T15:26:50.0666667+00:00

@Anonymous Thank you for reaching out to us, As I understand you want to understand the concepts of tenant, directory and domain within Azure.

In Azure, a tenant, directory, and domain are related but distinct concepts. Here's a brief explanation of each:

Tenant: A tenant is a dedicated and isolated instance of the Azure Active Directory (Azure AD)/Microsoft Entra ID service that an organization receives when it signs up for a Microsoft cloud service such as Azure, Microsoft 365, or Dynamics 365. Each tenant has its own identity and access management scope, and is distinct and separate from other tenants. A tenant is also associated with a unique tenant ID, which is a globally unique identifier (GUID) that identifies the tenant in Azure AD.

Directory: A directory is a container for objects such as users, groups, and applications, and is used to manage access to resources in Azure. A directory is also associated with a unique directory ID, which is a GUID that identifies the directory in Azure AD.

Domain: A domain is a name that identifies a group of resources on the internet, such as a website or an email server. In Azure, a domain is used to verify ownership of a custom domain name and to create user names and email addresses for users in a tenant. A domain can be associated with one or more tenants, and each tenant can have multiple domains.

The main difference between a tenant and a directory is that a tenant is a dedicated and isolated instance of Azure AD/Entra ID, while a directory is a container for objects such as users, groups, and applications. A tenant can contain one or more directories, and each directory can contain one or more tenants.

In summary, a tenant is a dedicated and isolated instance of Azure AD that an organization receives when it signs up for a Microsoft cloud service, while a directory is a container for objects such as users, groups, and applications, and is used to manage access to resources in Azure. A domain is a name that identifies a group of resources on the internet, and is used to verify ownership of a custom domain name and to create user names and email addresses for users in a tenant.

Reference: https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-create-new-tenant

https://techcommunity.microsoft.com/t5/azure/relationship-between-azure-active-directory-and-directory-tenant/m-p/1605314 similar discussion can be read here.

Let me know if you have any further questions, feel free to post back.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.
Please sign in to rate this answer.

11 people found this answer helpful.
Datha Sai Chandu 65 Reputation points

2023-12-15T06:45:58.59+00:00

Thank you so much @Givary-MSFT . Now i have a clear idea on what is what.

The image is a part of your answer.

In my study process, i never heard of having multiple directories in a single tenant, Is it a correction? as azure portal does not have a feature of creating more than one directory to a single tenant.

Givary-MSFT 32,311 Reputation points Microsoft Employee

2023-12-15T10:22:00.75+00:00

@datha sai That statement is correct, with paid license one can create multiple directories/tenants, with free/trial license this option of creating tenant is not possible, this has been changed recently, will try to get the document updated.

Thomas SCHWENDER 15 Reputation points

2024-01-26T16:05:04.2966667+00:00

Thank for your answer @Givary-MSFT , but I find it confusing when compared with the other article that you quote (https://techcommunity.microsoft.com/t5/azure/relationship-between-azure-active-directory-and-directory-tenant/m-p/1605314)

You are saying "A tenant can contain one or more directories, and each directory can contain one or more tenants", meaning to my understanding a "n:n" relationship between those 2 concepts.

On the other hand, the other article explains :

"I see it this way: Azure AD tenant = directory, and there is a strict 1:1 relationship between them (you cannot create several directories under a tenant)."

"When you use 'Switch directories' option in the Portal, you are authenticating to a different AAD tenant"

The author even says "I saw some confusing or even wrong replies in the "linked" topic like someone claiming you can have several directories under one AAD tenant."

So in the end "what is true".
Is there right now, 2024/01, some clear and up-to-date documentation on that point ?

Chalam Ponnusamy 5 Reputation points

2024-02-06T15:21:32.5366667+00:00

Wish we get one and only one document that clearly states what is what.

Raviraj G 10 Reputation points

2024-02-16T11:52:18.86+00:00

Tenant:

Imagine Azure as a vast city, where each organization represents a different neighborhood within that city.

A tenant in Azure is like owning a property (house) in one of these neighborhoods. Each organization (tenant) has its own property with its own set of rules and resources.

With a paid license, organizations have the option to own multiple properties (houses) in different neighborhoods, allowing them to manage distinct sets of resources and users.

However, with a free or trial license, organizations are limited to owning only one property (house) in their chosen neighborhood, and they cannot acquire additional properties.

Directory:

The directory can be likened to the neighborhood association or community center within each neighborhood.

Each neighborhood (tenant) has its own community center (directory), which serves as a central hub for managing residents (users), facilities, and events within that neighborhood.

The community center (directory) maintains a list of residents (users), organizes activities, and ensures compliance with neighborhood rules and regulations.

Just as each neighborhood has its own community center with its own set of rules, each tenant has its own directory that governs access to resources and manages identity-related tasks.

Domain:

A domain is like the street address for each property within a neighborhood.

It identifies the location of each property and is used for communication and navigation purposes.

In Azure, a domain is used to verify ownership of a custom address (domain name) and to create user identities and email addresses within a tenant.

Each property (house) within a neighborhood (tenant) can have multiple addresses (domains) associated with it for different purposes, such as email communication or website hosting.

In summary, in this analogy, Azure is depicted as a city with neighborhoods, where each organization (tenant) owns property (house) within a neighborhood. The neighborhood association (directory) manages the affairs of each neighborhood, while street addresses (domains) uniquely identify each property within a neighborhood. The ability to own multiple properties is restricted based on the type of license, with paid licenses offering this option while free/trial licenses do not.

Sequinel, Eduardo 15 Reputation points

2024-02-26T13:33:42.3233333+00:00

@Raviraj G

Thanks for trying to answer, but...

First you say
"A tenant in Azure is like owning a property (house) in one of these neighborhoods."
Then:
"Each neighborhood (tenant) has its own community center (directory)"

It's confusing, because you say "tenant = neighborhood" right after saying something completely different.
Neither Microsoft nor anyone could satisfactorily answer the question, so far.
I'm interested in the answer, too.

sanjaya sapkota 0 Reputation points

2024-08-12T11:14:37.89+00:00

repeated same sentence from top to bottom
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Help me to understand the concepts of tenant, directory and domain.

0 additional answers

Your answer