One login, many tenants: how sign-in finds your organization

How sign-in routing works

Every "Sign in with Microsoft" round-trip follows the same path:

The lookup key is the tenant ID, a GUID that Microsoft guarantees and signs. GraphPaaS never guesses from the email address.

Why not route by email domain?

Because email domains lie, and tenant IDs can't:

• A company can have many domains in one Entra tenant (fabrikam.com, fabrikam.pt, fabrikam-labs.io). All of them belong to the same tenant ID — so all of those users land in the same GraphPaaS organization, as they should.
• Guest users keep their home email ([email protected]) while living in your tenant directory. Routing by domain would send them to the wrong place; routing by tid sends them exactly where their account lives.
• An email domain can be typed by anyone; a tenant ID arrives inside a token signed by Microsoft. There is nothing to spoof.

Scenario 1 — two separate companies

You run @fabrikam.com and @sandbox.pt, and they are two different Entra tenants:

Each organization has its own dashboard, its own users, its own plan. Data is isolated end to end — one org can never see another's metrics, even if the same human owns both.

Scenario 2 — one company, many domains

If fabrikam.com and fabrikam.pt are the same Entra tenant, everyone lands in the same GraphPaaS organization regardless of which email they use. No configuration needed.

Scenario 3 — an MSP managing many client tenants

This is what GraphPaaS is built for. One organization can hold multiple Microsoft tenants:

You add client tenants from Settings → Tenants (each one gets a consent link for the client's admin), and switch between them with the tenant switcher in the dashboard header. Your team signs in once — with your MSP identities — and sees every client tenant your plan allows.

Who becomes admin?

• The first user to sign in for a new tenant becomes its tenant admin.
• Everyone after that arrives as a viewer until an admin promotes them (Settings → Team).
• Admins can also invite teammates by email: the invitation is linked to their Microsoft account on their first login, keeping the role they were invited with.
• Seats are counted per organization — when the plan's seat limit is reached, new sign-ins are blocked until a seat frees up.

What if my tenant isn't registered yet?

A sign-in from an unknown tenant doesn't create anything by accident. You'll see a "not onboarded" screen — unless you started from a pricing CTA on our landing page, in which case GraphPaaS creates your organization, walks you through the admin consent step (a one-time approval by your Microsoft admin) and starts the first sync.

Questions about a setup we didn't cover? Get in touch — multi-tenant edge cases are our favourite kind.