This chapter covers Azure Tenants and their relationship to Azure subscriptions and Microsoft Entra ID directories. AZ-900 tests this under objective 2.1, connecting identity concepts to the broader organizational structure of Azure.
Jump to a section
A simple way to picture Azure Tenants and Directories
A national ID card identifies you as a citizen of a specific country and unlocks access to government services and benefits tied to that citizenship. An Azure tenant works similarly — it's your organization's identity within Azure, connected to a Microsoft Entra ID (Azure AD) directory that manages who in your organization can access Azure resources and services.
What a tenant is
An Azure tenant is an instance of Microsoft Entra ID (Azure Active Directory) that manages the identity and access for an organization's use of Azure. When an organization signs up for Azure, a tenant (along with an associated Entra ID directory) is created, tied to that organization's domain.
The relationship between tenants, subscriptions, and Entra ID
One tenant can contain multiple subscriptions — an organization might have separate subscriptions for different business units or environments, but they all exist within the same tenant. The tenant contains the Entra ID directory that manages identity and access across all those subscriptions.
Multi-tenant scenarios
Some organizations use multiple tenants (for example, separate tenants for different subsidiaries or legal entities), though managing multiple tenants adds operational complexity — most organizations operate with a single tenant.
Why it matters
Understanding that Azure resources exist within a tenant, managed by an Entra ID directory, is important for understanding how identity and access control work across an organization's Azure deployment.
Recognize that your Azure subscriptions exist within a tenant
When your organization signs up for Azure, a tenant is created, containing the Entra ID directory managing identity for your organization.
Understand that one tenant can contain multiple subscriptions
An organization can have separate subscriptions for different purposes, but they all exist within the same tenant and use the same Entra ID directory.
Recognize the tenant-Entra ID relationship
The tenant's Entra ID directory manages identity and access for all subscriptions within the tenant — access control flows through Entra ID.
An organization's Azure subscriptions (for development, production, finance, and other business areas) all exist within a single tenant, with a single Entra ID directory managing identity and access across all of them.
Objective 2.1 expects a basic understanding of what a tenant is and its relationship to subscriptions and Entra ID.
A common wrong answer is confusing a tenant with a subscription — a subscription is a billing boundary; a tenant is an organizational boundary containing potentially multiple subscriptions and managed by an Entra ID directory.
Stable terms: tenant, Entra ID directory. Memory trick: a tenant = your organization's Azure identity container, managed by an Entra ID directory.
An Azure tenant is an instance of Microsoft Entra ID that manages identity and access for an organization.
One tenant can contain multiple subscriptions.
The tenant's Entra ID directory manages access across all subscriptions within it.
Most organizations operate with a single tenant, though multi-tenant scenarios exist.
These come up on the exam all the time. Here's how to tell them apart.
Tenant
Organizational identity container
Contains one or more subscriptions
Managed by a single Entra ID directory
Subscription
Billing boundary
Resources belong to one subscription
Exists within a tenant
Mistake
A tenant and a subscription are the same thing.
Correct
A subscription is a billing boundary for Azure resources. A tenant is an organizational container that can hold multiple subscriptions, all managed by a single Entra ID directory.
Mistake
Every organization needs multiple tenants.
Correct
Most organizations operate with a single tenant — multiple tenants are used in more complex scenarios but add operational complexity.
It's an instance of Microsoft Entra ID that manages identity and access for an organization's use of Azure. When an organization signs up for Azure, a tenant is created, containing the Entra ID directory.
Yes — a single tenant can contain multiple subscriptions for different business units or purposes, all managed by the same Entra ID directory.
Most organizations operate with a single tenant. Multiple tenants are used in more complex scenarios, but managing multiple tenants adds operational complexity.
You've just covered Azure Tenants and Directories — now see how well it sticks with free AZ-900 practice questions. Full explanations included, no account needed.
Done with this chapter?