# Azure Tenants and Directories

> Chapter 65 of the Courseiva AZ-900 curriculum — https://courseiva.com/learn/az-900/azure-tenants

**Official objective:** 2.1 — Azure Architecture Services

## Introduction

This chapter covers Azure Tenants and their relationship to Azure subscriptions and Microsoft Entra ID directories. AZ-900 tests this under objective 2.1, connecting identity concepts to the broader organizational structure of Azure.

## Your Company's Identity Card

A national ID card identifies you as a citizen of a specific country and unlocks access to government services and benefits tied to that citizenship. An Azure tenant works similarly — it's your organization's identity within Azure, connected to a Microsoft Entra ID (Azure AD) directory that manages who in your organization can access Azure resources and services.

## Core explanation

### What a tenant is
An Azure tenant is an instance of Microsoft Entra ID (Azure Active Directory) that manages the identity and access for an organization's use of Azure. When an organization signs up for Azure, a tenant (along with an associated Entra ID directory) is created, tied to that organization's domain.

### The relationship between tenants, subscriptions, and Entra ID
One tenant can contain multiple subscriptions — an organization might have separate subscriptions for different business units or environments, but they all exist within the same tenant. The tenant contains the Entra ID directory that manages identity and access across all those subscriptions.

### Multi-tenant scenarios
Some organizations use multiple tenants (for example, separate tenants for different subsidiaries or legal entities), though managing multiple tenants adds operational complexity — most organizations operate with a single tenant.

### Why it matters
Understanding that Azure resources exist within a tenant, managed by an Entra ID directory, is important for understanding how identity and access control work across an organization's Azure deployment.

## Real-world context

An organization's Azure subscriptions (for development, production, finance, and other business areas) all exist within a single tenant, with a single Entra ID directory managing identity and access across all of them.

## Exam focus

Objective 2.1 expects a basic understanding of what a tenant is and its relationship to subscriptions and Entra ID.

A common wrong answer is confusing a tenant with a subscription — a subscription is a billing boundary; a tenant is an organizational boundary containing potentially multiple subscriptions and managed by an Entra ID directory.

Stable terms: **tenant**, **Entra ID directory**. Memory trick: a tenant = your organization's Azure identity container, managed by an Entra ID directory.

## Step by step

1. **Recognize that your Azure subscriptions exist within a tenant** — When your organization signs up for Azure, a tenant is created, containing the Entra ID directory managing identity for your organization.
2. **Understand that one tenant can contain multiple subscriptions** — An organization can have separate subscriptions for different purposes, but they all exist within the same tenant and use the same Entra ID directory.
3. **Recognize the tenant-Entra ID relationship** — The tenant's Entra ID directory manages identity and access for all subscriptions within the tenant — access control flows through Entra ID.

## Comparisons

### Tenant vs Subscription

**Tenant:**
- Organizational identity container
- Contains one or more subscriptions
- Managed by a single Entra ID directory

**Subscription:**
- Billing boundary
- Resources belong to one subscription
- Exists within a tenant

## Common misconceptions

- **Misconception:** A tenant and a subscription are the same thing. **Reality:** A subscription is a billing boundary for Azure resources. A tenant is an organizational container that can hold multiple subscriptions, all managed by a single Entra ID directory.
- **Misconception:** Every organization needs multiple tenants. **Reality:** Most organizations operate with a single tenant — multiple tenants are used in more complex scenarios but add operational complexity.

## Key takeaways

- An Azure tenant is an instance of Microsoft Entra ID that manages identity and access for an organization.
- One tenant can contain multiple subscriptions.
- The tenant's Entra ID directory manages access across all subscriptions within it.
- Most organizations operate with a single tenant, though multi-tenant scenarios exist.

## FAQ

**What is an Azure tenant?**

It's an instance of Microsoft Entra ID that manages identity and access for an organization's use of Azure. When an organization signs up for Azure, a tenant is created, containing the Entra ID directory.

**Can one tenant contain multiple subscriptions?**

Yes — a single tenant can contain multiple subscriptions for different business units or purposes, all managed by the same Entra ID directory.

**Do I need multiple tenants?**

Most organizations operate with a single tenant. Multiple tenants are used in more complex scenarios, but managing multiple tenants adds operational complexity.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/az-900/azure-tenants