Is Using a Multi-Tenant Service Principal and ARM APIs the Standard Approach for Cross-Tenant Resource Deployment?

Using a multitenant application registration and calling Azure Resource Manager (ARM) APIs is a valid and commonly used pattern for cross-tenant deployments, especially for managed service provider (MSP) and SaaS scenarios. However, it is not the only pattern and is best viewed as one of several supported approaches rather than the single “standard” for all cases.

Key points from the guidance:

1. Multitenant vs. single-tenant Entra design
   • Guidance explicitly advises against creating multiple Microsoft Entra tenants for most multitenant solutions. Instead, it recommends using a single Microsoft Entra tenant with management groups and subscriptions to organize resources where possible.
   • Multiple Entra tenants are typically used only by MSPs operating Azure environments on behalf of customers, or when customers require resources to live in their own tenants.
   • When resources must be deployed into subscriptions tied to multiple Entra tenants, Azure Lighthouse is recommended to help manage resources across tenants.
2. Approaches for automation across multiple tenants The Cloud Adoption Framework describes two main approaches for automating Azure landing zones across multiple Entra tenants:
   • Approach 1 – Complete isolation
     • Each Microsoft Entra tenant has its own isolated automation components: separate Git repos, CI/CD (GitHub Actions/Azure Pipelines), and identities (service principals, managed identities, etc.).
     • This is used when strong isolation and regulatory requirements demand strict separation between tenants.
   • Approach 2 – Shared application registration (multitenant) with multiple service principals
     • A shared multitenant app registration is used, with a service principal created in each customer tenant.
     • Often combined with the deployment stamps pattern to deploy an almost identical architecture across many tenants at scale.
     • This pattern aligns closely with the approach being evaluated: a multitenant app registration authenticating to ARM to deploy resources in customer subscriptions.
   These approaches are presented as examples that can be mixed and matched based on organizational requirements, not as a single mandated standard.
3. ARM, IaC, and deployment patterns
   • Azure Resource Manager is the core service for creating, managing, and deleting Azure resources. For multitenant solutions, it is recommended to use infrastructure as code (IaC) and deployment pipelines rather than manual operations.
   • Recommended tools and patterns include:
     • Bicep or ARM templates, Terraform, or other IaC tools that call ARM.
     • Template specs to centrally store and reuse parameterized templates for tenant-specific deployments.
     • Deployment stacks to manage sets of tenant resources as a single logical unit, even across resource groups or subscriptions, and to simplify offboarding.
   • Automation is strongly recommended for multitenant deployments to achieve scale, repeatability, and reduced outage risk.
4. Recommended practices for cross-tenant deployments For a scenario where an application deploys resources into customer subscriptions:
   • Use a multitenant app registration with per-tenant service principals (Approach 2) when:
     • Operating in an MSP or SaaS model where customers keep their own Entra tenants/subscriptions.
     • A consistent, stamp-based architecture is deployed per customer.
   • Consider Azure Lighthouse when:
     • Ongoing management and operations across many customer tenants are required, not just initial deployment.
   • Use IaC and deployment pipelines:
     • Define all customer resources via Bicep/ARM/Terraform.
     • Optionally use template specs and deployment stacks to standardize and manage tenant environments.
   • Avoid antipatterns:
     • Manual deployment and testing.
     • One-off, tenant-specific customizations that complicate deployments; instead, use a common codebase and configuration (feature flags, pricing tiers, etc.).

Summary:

Using a multitenant app registration (service principal) plus ARM APIs to deploy resources into customer subscriptions is a recommended and common approach for cross-tenant deployments, particularly in MSP-style and multitenant SaaS scenarios. It aligns with the documented “shared application registration (multitenant) with multiple service principals” pattern and should be combined with IaC, deployment pipelines, and, where appropriate, Azure Lighthouse and deployment stamps/stacks for scale and manageability.

References:

• Automate Azure landing zones across multiple tenants
• Organize Azure resources in multitenant solutions
• Multitenancy and Azure Resource Manager
• Architectural approaches for the deployment and configuration of multitenant solutions