What is an Azure AD tenant?

What is a Microsoft Entra ID tenant?

A tenant is a dedicated, isolated instance of the Microsoft Entra ID service (previously Azure Active Directory, or Azure AD) that represents a single organization. Your organization receives a tenant automatically when it subscribes to any Microsoft cloud service, whether that's Microsoft 365, Azure, or Dynamics 365.

Each tenant has a globally unique tenant ID (a GUID) and a default domain in the format yourorg.onmicrosoft.com. You can add custom domains, but the default domain always stays as a fallback.

Think of the tenant as the trust boundary for your organization. Authentication, authorization, and policy enforcement all happen within it. Users in Tenant A can't access resources in Tenant B unless you explicitly configure cross-tenant collaboration through B2B guest access.

That isolation is architectural, not just a policy setting. Each tenant runs as a logically separate instance of the Entra ID service with its own directory partition.

Key components of a tenant

Tenant vs. directory vs. subscription

These three terms trip up administrators constantly, and the distinction matters for both architecture and security.

Your tenant is the organizational identity boundary, the dedicated instance of Microsoft Entra ID that your organization controls. The directory is the identity object store within that tenant, containing your users, groups, applications, and devices.

In practice, Microsoft documentation often uses "tenant" and "directory" interchangeably because every tenant has exactly one directory and the two are created together.

A subscription is something else entirely. It's a billing and resource management container for Azure services. One tenant can hold multiple subscriptions (say, separate ones for development, staging, and production), but each subscription belongs to exactly one tenant.

How a tenant works

When a user enters their credentials, the Microsoft Entra ID tenant validates the identity, issues tokens, and the target application grants access based on the claims in those tokens. The tenant is where policy gets enforced. Conditional Access policies, MFA requirements, and role-based access controls are all scoped to the tenant and evaluated at sign-in time.

In hybrid environments, organizations running on-premises Active Directory alongside Microsoft Entra ID use Microsoft Entra Connect (previously Azure AD Connect) to synchronize identities between the two. The tenant becomes the bridge between your on-premises directory and cloud identity, so users authenticate against whichever identity source the request requires.

In multi-tenant scenarios, SaaS applications can serve users from multiple tenants at once. Each tenant's data stays logically isolated within the application. This is the architecture behind Microsoft 365, Salesforce, and most enterprise SaaS products.

Security risks targeting tenants

Tenant misconfigurations and overlooked hygiene gaps give attackers reliable entry points into your cloud environment. The risks below are specific to tenant architecture and worth monitoring deliberately.

Consent phishing and illicit consent grants. Attackers create malicious OAuth applications and trick users into granting consent. Once a user approves the application's permission request, the attacker's app can read email, access files, and query profile data, all without ever needing the user's password. Microsoft's own documentation identifies illicit consent grants as a distinct attack pattern and provides an investigation playbook for it.

Overprivileged role assignments. Global Administrator is the most powerful role in a tenant. Organizations that assign this role broadly create unnecessary exposure. Only Global Administrator and Privileged Role Administrator can assign or remove directory roles; any other role, including User Administrator, lacks that permission.

When too many accounts hold Global Administrator, a single compromised credential gives an attacker unrestricted control over the entire tenant.

Stale and inactive accounts. Former employees, expired contractor accounts, and forgotten test accounts that remain enabled in the tenant become targets for credential stuffing and account takeover. These accounts often have no owner watching their sign-in activity, making them ideal for quiet compromise.

Cross-tenant lateral movement via B2B. If an attacker compromises a guest account with B2B access, they can try to pivot from the compromised tenant into partner tenants where the guest identity has permissions. The attack surface grows with every B2B trust relationship your organization maintains.

Conditional Access bypass. Misconfigured Conditional Access policies leave gaps that attackers exploit. Legacy authentication protocols (SMTP, IMAP, POP3) don't support MFA, so any policy that leaves legacy authentication enabled provides a bypass path. Trusted locations set too broadly can weaken the intended controls similarly.

Expired domain tenant takeover. If your organization's custom domain registration lapses, an attacker can re-register it and potentially intercept password reset emails or authentication redirects that reference the custom domain. Microsoft has documented this risk vector in its domain security guidance.

ADAudit Plus detects risky cloud configurations across Azure, AWS, and GCP through its Attack Surface Analyzer. It also monitors Entra ID sign-in activity, including sign-ins from anonymized IP addresses, impossible travel scenarios, and leaked credentials, through its Risk Detection reports.

Limitations of native tenant monitoring

The Microsoft Entra ID admin center provides sign-in and audit logs, but the native toolset has practical limits that affect how quickly you can detect and respond to threats.

Sign-in logs are retained for 30 days on Entra ID Free and P1 plans. If you need longer retention, you have to export logs to Azure Monitor, a SIEM, or a storage account. That export pipeline requires separate configuration and ongoing maintenance.

The admin center doesn't generate real-time alerts on tenant changes out of the box. If someone assigns the Global Administrator role, modifies a Conditional Access policy, or grants OAuth consent to a new application, no native notification fires unless you've separately configured Azure Monitor alert rules or Logic Apps workflows.

Automated incident response isn't available from the admin center alone. When a suspicious sign-in is detected, an administrator has to manually investigate and decide on a response. There's no built-in mechanism to automatically disable an account, revoke a session, or create a support ticket based on a detected anomaly.

Hybrid environments face a visibility gap. On-premises AD events and Entra ID events live in separate consoles with no native single-pane view. Correlating a suspicious on-premises logon with a risky cloud sign-in means switching between two toolsets and piecing the picture together yourself.

Compliance teams can't schedule recurring tenant activity reports for email delivery from the admin center without third-party tooling or custom Power Automate flows. Audit log queries in Azure Monitor require Kusto Query Language (KQL), which adds a learning curve for administrators who don't have analytics experience.

Monitoring tenant activity with ADAudit Plus

What ADAudit Plus monitors in your tenant

ADAudit Plus covers Entra ID activity through pre-built reports in the Cloud Directory tab. Each report category below maps to a specific area of tenant security.

Sign-in monitoring: Logon Activity, Logon Failures, Logon Failure due to bad password, Logon Activity by Legacy Authentication, Logon Activity by IP Address, Hybrid Logon Activity, and Logon Activity by Applications. These reports capture geo-location, device information, MFA status, and Conditional Access evaluation results for every sign-in event.

Risk detection: Risky Logon Activity, Login by Anonymized IP Address, Login by PasswordSpray Account, Impossible travel to atypical locations, Login with leaked credentials, and Login by Malicious IP Address. These reports surface sign-in events flagged by Entra ID Identity Protection so you can investigate without switching consoles.

User management: Recently Created Users, Recently Deleted Users, Recently Updated Users, Recently Enabled Users, Recently Disabled Users, Recently Password Changed Users, and Recently Password Reset Users. Each report includes the caller identity so you can trace who made the change.

Role management: Recently Added Member to Role and Recently Removed Member from Role. These reports track every Entra ID role assignment and removal, giving you visibility into privilege changes across the tenant.

Group management: Recently Created Groups, Recently Added Members to Groups, and Recently Removed Members from Groups.

Application management: Recently Added Application, Recently Added OAuth2.0 Permission, Recently Consent to Application, and Recently Revoke Consent Application. These reports are your primary defense against illicit consent grants because they surface every OAuth permission change in a dedicated view.

Conditional Access policy changes: Add Conditional Policy, Update Conditional Policy, and Delete Conditional Policy.

MFA monitoring: Login with MFA disabled account, Login with MFA enabled account, Logon Failure due to MFA failed, and Logon based on MFA method.

Native Entra ID admin center vs. ADAudit Plus

FAQ