Can you do multi-tenant Azure Active Directory?

• You cannot have one Azure AD instance for multiple tenants since tenants are subscription based and every tenant can be specified as an independent directory having its own custom domain name with verified DNS records as the authoritative start of the authority for all the user identities created in it. Thus, it acts as a central authentication and authorization directory for all the identities and applications created in it.

As a result, as of now, only applications in an Azure AD tenant can be configured as multi-tenant, i.e., multiple tenants share the same physical instance of the app. Although tenants share physical resources (such as VMs or storage), each tenant gets its own logical instance of the app wherein application data is shared amongst the users within a tenant, but not with other tenants.

• Thus, since you are migrating from IdentityServer4 to Azure AD, you must configure Azure AD as a federation IDP and configure your IdentityServer4 in that way such that when a user tries to login to a SaaS app through a user identity that is created in IdentityServer4, then he is redirected to the Azure AD for authentication purposes and accordingly token is issued and once again, he is redirected to IdentityServer4 for further application based purpose.

To configure an application as a multi-tenant application, kindly refer to the below snapshots for reference: -

Also, to add ‘IdentityServer4’ as an IDP to Azure AD, kindly ensure to add it as an ‘App Registration’ in your new Azure AD tenant as stated below and ensure to add the same details in your SaaS app that is configured for authentication with ‘IdentityServer4’: -

• Register your application with your new Azure Active Directory tenant by clicking on App Registrations --> Register an application --> Name: IdentityServer4 --> Accounts in any organizational directory

• Then, in the Redirect URI field, enter the ‘callback/redirect URI’ path configured in IdentityServer4 for Azure AD authentication which will be like ‘http://localhost:5000/signin-aad’ which you can find it in the ‘IdentityServer4’ project in the ‘Startup’ class in the ‘ConfigureServices’ method.

• Also, ensure to configure the token and redirect URI as below: -

This will ensure that ‘Azure AD’ is configured as an external identity provider in your application as below by configuring the correct ‘Application ID, Tenant ID, etc. correctly. In this way, you can surely configure ‘IdentityServer4’ as an IDP in Azure AD: -

    services.AddAuthentication()
    .AddOpenIdConnect("aad", "Azure AD", options =>
    {
        options.SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme;
        options.SignOutScheme = IdentityServerConstants.SignoutScheme;

        options.Authority = "https://login.windows.net/<Directory (tenant) ID>";
        options.ClientId = "<Your Application (client) ID>";
        options.ResponseType = OpenIdConnectResponseType.IdToken;
        options.CallbackPath = "/signin-aad";
        options.SignedOutCallbackPath = "/signout-callback-aad";
        options.RemoteSignOutPath = "/signout-aad";
        options.TokenValidationParameters = new TokenValidationParameters
        {
            NameClaimType = "name",
            RoleClaimType = "role"
        };
    });

Please find the below link for more detailed clarification on this: -

https://www.ashleyhollis.com/how-to-configure-azure-active-directory-with-identityserver4

https://identityserver4.readthedocs.io/en/latest/endpoints/authorize.html

Hello @fred and thanks for your question. As an IdP, Azure AD is indeed multi-tenant, however instead of targeting a tenant you target a multi-tenant app.

Regarding IdentityServer4 acr_values param, it's meant to be used to bypass IdP selection thus it's not needed since you only need to pass the proper client_id param and build the Azure AD protocol specific (OIDC/OAuth2) endpoint using a multi-tenant id such as organizations or common. E.g. https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration