One login, many tenants: how sign-in finds your organization

TL;DR — you never have to tell GraphPaaS who you are. When you sign in with Microsoft, your account's Entra tenant ID travels inside Microsoft's signed token, and that ID — not your email domain — decides which GraphPaaS organization you land in. you@fabrikam.com and you@sandbox.pt end up in different organizations automatically, with zero shared data between them.

How sign-in routing works

Every "Sign in with Microsoft" round-trip follows the same path:

 You click "Sign in"
        │
        ▼
 Microsoft login  ──  you authenticate against YOUR company's
        │             Microsoft Entra tenant (password, MFA…)
        ▼
 Microsoft returns a signed token containing:
   • tid  → your Entra tenant ID
   • oid  → your user ID inside that tenant
        │
        ▼
 GraphPaaS looks up the tenant by tid
        │
        ├─ tenant registered & active ──► your org's dashboard
        ├─ tenant pending consent ─────► onboarding wizard
        └─ tenant unknown ─────────────► "not onboarded" screen
                                          (or self-signup, if you
                                           came from a pricing CTA)

The lookup key is the tenant ID, a GUID that Microsoft guarantees and signs. GraphPaaS never guesses from the email address.

Why not route by email domain?

Because email domains lie, and tenant IDs can't:

• A company can have many domains in one Entra tenant (fabrikam.com, fabrikam.pt, fabrikam-labs.io). All of them belong to the same tenant ID — so all of those users land in the same GraphPaaS organization, as they should.
• Guest users keep their home email (partner@othercompany.com) while living in your tenant directory. Routing by domain would send them to the wrong place; routing by tid sends them exactly where their account lives.
• An email domain can be typed by anyone; a tenant ID arrives inside a token signed by Microsoft. There is nothing to spoof.

Scenario 1 — two separate companies

You run @fabrikam.com and @sandbox.pt, and they are two different Entra tenants:

 you@fabrikam.com ──► tid A ──► Org "Fabrikam"   (its own data,
                                                  users, billing)
 you@sandbox.pt  ───► tid B ──► Org "Sandbox"    (fully isolated)

Each organization has its own dashboard, its own users, its own plan. Data is isolated end to end — one org can never see another's metrics, even if the same human owns both.

Scenario 2 — one company, many domains

If fabrikam.com and fabrikam.pt are the same Entra tenant, everyone lands in the same GraphPaaS organization regardless of which email they use. No configuration needed.

Scenario 3 — an MSP managing many client tenants

This is what GraphPaaS is built for. One organization can hold multiple Microsoft tenants:

 Org "Your MSP"
   ├── Tenant: client-one.com      ◄─ admin consent granted
   ├── Tenant: client-two.com      ◄─ admin consent granted
   └── Tenant: client-three.com    ◄─ pending consent

You add client tenants from Settings → Tenants (each one gets a consent link for the client's admin), and switch between them with the tenant switcher in the dashboard header. Your team signs in once — with your MSP identities — and sees every client tenant your plan allows.

Who becomes admin?

• The first user to sign in for a new tenant becomes its tenant admin.
• Everyone after that arrives as a viewer until an admin promotes them (Settings → Team).
• Admins can also invite teammates by email: the invitation is linked to their Microsoft account on their first login, keeping the role they were invited with.
• Seats are counted per organization — when the plan's seat limit is reached, new sign-ins are blocked until a seat frees up.

What if my tenant isn't registered yet?

A sign-in from an unknown tenant doesn't create anything by accident. You'll see a "not onboarded" screen — unless you started from a pricing CTA on our landing page, in which case GraphPaaS creates your organization, walks you through the admin consent step (a one-time approval by your Microsoft admin) and starts the first sync.

---

Questions about a setup we didn't cover? Get in touch — multi-tenant edge cases are our favourite kind.