Learn how Microsoft Entra Tenant Governance helps you discover and govern tenants across your organization to establish an AI-ready secure foundation
Today, we’re excited to announce the general availability of Microsoft Entra Tenant Governance, a built-in capability that helps organizations centrally govern and secure multi-tenant environments at scale.
Why centralized tenant governance matters
Tenants represent your organization, housing its identities, applications, data, and cloud and AI services. Protecting them is not just a security requirement, it’s a prerequisite for AI readiness, fueling the secure, resilient environment that AI-powered operations depend on.
Most enterprises operate across dozens, or even hundreds, of tenants: primary, production, test, demo, and sometimes employee-created. Over time, primary tenants can experience configuration drift, introducing significant security risks. Meanwhile, unmanaged or legacy, often invisible to central IT, creating blind spots that expand the attack surface. Centralized tenant governance addresses these gaps by bringing all tenants into view and under control. The goal is straightforward – security and identity teams can enforce consistent security standards, reduce the risk of shadow tenants, and proactively govern the entire tenant estate at scale.
An end-to-end tenant governance solution
Built on learnings from Microsoft’s own response to a high-profile sophisticated incident, Microsoft Entra Tenant Governance helps you move beyond reactive incident response to proactive, scalable governance across the tenant lifecycle. The solution unifies four capabilities:
- Related tenants: Identify tenants across your organization’s environment and map out how each relates to your business, helping you assess which to bring under governance and reducing blind spots before they turn into incidents. For recommendations on how to organize your tenants, refer to our new Microsoft Entra tenant estate architecture guide.
- Governance relationships: Bring related tenants under control with least-privileged, cross-tenant delegated administration, a capability that also enables multi-tenant agent and Microsoft Defender XDR management.
- Tenant configuration management: Define configuration baselines that express the required state of tenant configuration settings across Microsoft Defender, Microsoft Entra, Microsoft Exchange Online, Microsoft Intune, Microsoft Purview, and Microsoft Teams, then continuously monitor tenant settings against those baselines.
- Secure tenant creation: Govern new tenants from day one by controlling which users can create new tenants and automatically set up governance relationships with those tenants.
“Tenant Governance enables us to establish least-privileged governance relationships and continuously monitor each tenant for configuration drift against our Golden Security Baseline, giving us consistent visibility across our tenant estate."
– Global Enterprise software businesses
What’s new since public preview
Since public preview, we’ve introduced these improvements and features:
- Increased limits on configuration monitors and snapshots per tenant for greater scalability. Customers with ID Governance, Entra Suite or Microsoft E7 licenses now have higher daily and monthly limits of configuration monitors and snapshots.
- Richer tenant discovery insights for deeper visibility into related tenants within your organization.
- Simplified configuration monitoring with new admin portal experiences, currently in preview, making it easy to create monitors from snapshots and ensure proper permissions.
- Enhanced delegated admin capabilities to streamline tenant switching and governance management across multiple tenants.
- Expanded secure tenant creation to support governed add-on tenants under legacy billing models, including Enterprise Agreement and Pay-As-You-Go subscriptions.
“Alongside these generally available capabilities, we’re pleased Microsoft has released new Tenant Governance admin portal experiences, making it easier to create monitors from snapshots and ensure the right permissions are in place."
– Global Enterprise software businesses
Tenant Governance in the real-world
To illustrate how organizations can use Microsoft Entra Tenant Governance, let’s explore two common scenarios with a fictitious company, Caldova, first bringing an unmanaged tenant under control, then keeping the primary tenant every employee depends on in a known-good state.
Scenario 1: Apply consistent policy to a (governed) test tenant
The situation: A Caldova employee created a test tenant, Caldova-Test, to trial a new feature that the company plans to launch in the coming months. Caldova-Test sits outside central IT's control – exactly the kind of shadow tenant that tends to miss foundational policies like Conditional Access.
Step 1: Discover related tenants. With Microsoft Entra Tenant Governance, the team can identify their tenant landscape, surfacing tenants that exist within their organization’s environment. A shared billing account signal exposes Caldova-Test, and drilling down further reveals multiple users from Caldova signing into admin applications in Caldova-Test.
Step 2: Establish a governance relationship. They bring Caldova-Test under central control through a request and approval process, creating a least-privileged governance relationship that grants the Tenant Governance Administrator role. Caldova admins can now deploy configuration monitors in Caldova-Test without creating another set of identities.
Step 3: Define the baseline. Caldova-Test has been missing foundational settings including Conditional Access policies, exposing the tenant to critical security risk. Managing Caldova-Test’s configuration at the moment is timely, starting with defining the configuration baseline for the tenant. Rather than writing a configuration from scratch, they snapshot the primary Caldova tenant that presents the desire state of tenant configuration settings.
Step 4: Monitor for drift. They continuously monitor for configuration drift, so deviations surface quickly.
Step 5: Remediate and refine. They address drift as it's reported, starting with targeted fixes, and refine the monitors over time as the governance program matures.
Scenario 2: Keep your primary tenant in a compliant, trusted state
Governing the tenants outside of central IT control is only one side of a coin. The primary tenant at the center of the business must hold the standard continuously, and it's the one teams most often overlook.
The situation: Caldova's IT team needs every setting and configuration in its primary tenant to meet organizational security and compliance requirements. During an audit, the team is flagged because the tenant no longer meets device compliance requirements. They need to pinpoint the cause and restore compliance quickly, and with Microsoft Entra Tenant Governance, this process could be done effortlessly.
Step 1: Capture a desired configuration baseline. From the Microsoft Entra admin center, the team had taken a snapshot of the tenant while it was in an approved, compliant state. They create a monitor from that snapshot.
Step 2: Detect drift automatically. The monitor runs continuous drift detection and flags that an Intune device compliance policy has changed. The drift detection report confirms that the policy was modified accidentally.
Step 3: Remediate with confidence. Because there's a record of what the policy should be and exactly what differs from it, the team restores the Intune device compliance policy to the approved configuration and brings the tenant back into compliance.
Without drift monitoring, the team would have to comb through audit logs, guess whether a change was malicious or accidental, and reconstruct the intended policy configuration. With Tenant Governance, the approved baseline is documented and deviations surface on their own. Learn more about drift monitoring in our demo.
Extending multi-tenant governance across the Microsoft Security ecosystem
As organizations extend AI agents across their environments, multi-tenant governance provides the foundation for securing them. Enabled by Microsoft Entra Tenant Governance, multi-tenant agent management – a Microsoft Agent 365 capability currently in preview, helps organizations prioritize remediation of risky agents across tenants and maintain a consistent rollout posture. Once a governance relationship between the governing and governed tenant is established in the Entra admin center, administrators can view agent inventory and activity, identify risky agents, and install or block agents in the governed tenant from the Microsoft 365 admin center. For licensing, establishing a governance relationship requires a Microsoft Entra Tenant Governance license in the governing tenant, and access to agent activity and risky-agent insights requires a Microsoft Agent 365 license in the governed tenant.
The governance relationship model also extends across Microsoft’s security portfolio and into the partner ecosystem. Administrators of Microsoft Defender and Sentinel can leverage delegated access in the Defender multi-tenant management experience, currently in preview, to centrally manage customer environments, including security incidents, alerts, and configurations across governed tenants. This enables partners, including MSPs and MSSPs, to administer customer tenants securely without requiring full administrative access.
Get started today
To get started, review the documentation and learn how to enable Microsoft Entra Tenant Governance in your production environment.
- Cindy Crane, Principal Product Manager
Additional resources
- Microsoft Entra tenant governance documentation
- Microsoft Entra tenant estate architecture guidance
- Microsoft Entra Tenant Governance deployment guide
- Microsoft Entra Tenant Governance licensing guide
Learn more about Microsoft Entra
Prevent identity attacks, ensure least privilege access, unify access controls, and improve the experience for users with comprehensive identity and network access solutions across on-premises and clouds.
Microsoft