Get continuous visibility into related tenants and the signals behind them—so you can reduce blind spots before they turn into incidents.
As organizations grow, so does their tenant footprint. Over time, tenants created for acquisitions, development projects, regional operations, or partner collaboration can fall outside central IT visibility, creating what many security teams now refer to as shadow tenants.
One of the foundational pillars of Microsoft Entra Tenant Governance is discovering related tenants. This capability helps you identify tenants connected to your environment through signals such as B2B collaboration, multitenant applications and shared billing relationships. With that visibility, you can reduce hidden security risks before they become incidents.
Let’s explore what this looks like in practice through the lens of the Related Tenants pillar.
Scenario: Contoso discovers its hidden tenant landscape
Contoso's IT security team knows about their primary production tenant and a handful of dev/test tenants. But after reading about the Midnight Blizzard attack, the CISO wants a complete picture. Are there tenants out there that Contoso doesn't know about?
Step 1: Turn on discovery. A Contoso admin, Alice, opens the Microsoft Entra admin center, navigates to Tenant governance > Related tenants, and enables discovery. It takes a single click—no infrastructure to configure.
Step 2: Discover what’s connected. Within hours, the system surfaces tenants connected to Contoso through cross-tenant signals (B2B collaboration, multitenant app registrations, and shared billing accounts). Alice sees 14 related tenants. The team recognizes nine of them. The other five are a mix of tenants from a 2023 acquisition that were never onboarded, a proof-of-concept tenant a partner team spun up, and two legacy test environments nobody remembered existed.
Step 3: Assess and act. For each discovered tenant, Contoso can see the relationship type and the signals behind it. The security team flags unknown tenants for review and immediately runs a quarantine workflow for one unsanctioned tenant that has high-risk multitenant app permissions:
- Confirm exposure. Validate which app permissions were granted, whether admin consent exists, and which users or workloads are affected.
- Block user sign-in paths. In cross-tenant access settings, add the suspect tenant and block inbound and outbound user sign-in so collaboration with that tenant is stopped without disrupting trusted tenants.
- Contain application access. Find enterprise applications whose “appOwnerOrganizationId” matches the suspect tenant, then revoke granted permissions or delete the corresponding service principals to cut off app-based access.
- Harden with tenant restrictions. Apply a tenant restrictions v2 policy through Global Secure Access and universal tenant restrictions so managed users can’t authenticate unsanctioned tenants.
- Validate and decide. Verify blocking in sign-in and audit logs, run a short scream test for business impact, then either onboard the tenant into governance relationships and policy baselines or keep it isolated until retirement.
Microsoft Entra Tenant Governance related tenants.
Microsoft Entra Tenant Governance discovery signals.
This isn’t a one-time scan. Related tenants are a continuously updated inventory; as new tenants appear in Contoso’s identity landscape, they surface automatically. No more blind spots waiting to be exploited.
Following the guidance in Discover your Microsoft cloud footprint, organizations can further expand their visibility by using additional telemetry sources including:
- Azure subscription billing data
- Authentication logs (Microsoft Entra sign-ins)
- Microsoft 365 activity
- Audit logs
These sources help organizations inventory all Microsoft tenants where users have signed in or resources are provisioned, identify cross-tenant relationships through app consent and Global Secure Access network traffic, and surface potential risks from tenants with elevated permissions or suspicious patterns.
For tenants that are discovered but not yet trusted, organizations can take immediate action using existing tenant quarantine capabilities to isolate potentially risky tenants and restrict their interactions until they've been assessed.
Important: Using the new add-on tenant creation flow is a crucial part of establishing a secure tenant landscape. To ensure organizations are using the most secure methods possible to create add-on tenants, the legacy workforce tenant creation flow will be retired August 15, 2026.
Get started
Threat actors continue to innovate, but so do we. By making tenant discovery a foundational part of your identity strategy, you can close gaps before adversaries find them.
To get started, enable related tenants discovery in the Microsoft Entra admin center or through the tenant governance API. Your feedback is instrumental in shaping these tools. We invite you to try the public preview and share your experience.
Stay secure, stay informed, and stay ahead.
-Cindy Crane, Principal Product Manager
Additional resources
- What is Microsoft Entra Tenant Governance? (preview) – Microsoft Entra ID Governance | Microsoft Learn
- Discover your Microsoft cloud footprint
Learn more about Microsoft Entra
Prevent identity attacks, ensure least privilege access, unify access controls, and improve the experience for users with comprehensive identity and network access solutions across on-premises and clouds.
Microsoft