Do multi-tenant applications gives ability to manage resources of users' accounts(tenants) individually by their own?

Sashin Sahasra 21 Reputation points
2021-07-08T10:58:58.21+00:00

I want to create an application using java sdk that can create storage accounts on azure cloud. So currently I'm using tenant_id, client_id, client_secret and subscription_id for get the access to the user tenant. My current approach is to do this by registering the application as multitenant. So, if I provide this application to users from a different tenants, will the storage account be created in their tenants seperately? Also can they get access to the resources in my tenant?

Azure Cloud Services
Azure Cloud Services
An Azure platform as a service offer that is used to deploy web and cloud applications.
695 questions
Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
808 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
21,699 questions
0 comments
Accepted answer
  1. AmanpreetSingh-MSFT 56,601 Reputation points
    2021-07-19T13:43:43.363+00:00

    Hi @Sashin Sahasra · Thank you for reaching out.

    When you create Multi-tenant application (e.g. App001) in tenant1 and users of tenant2 access that application, a service principal corresponding to App001 gets created in tenant2. The tenant2 can then issue token with audience App001's App ID URI and only App001 can consume the token.

    In order to create resources (e.g. Storage Account) in Azure, the audience must be https://management.core.windows.net/, which you cannot get in context of the service principal created in tenant2 corresponding to App001.

    Can they get access to the resources in my tenant?
    No, the users will not be added to your tenant when they access multi-tenant application. So you can't use RBAC to grant them access to the resources in the subscription linked to your tenant.

    -----------------------------------------------------------------------------------------------------------

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.