SOLVED

Relationship between Azure Active Directory and Directory (Tenant?)

%3CLINGO-SUB%20id%3D%22lingo-sub-1605314%22%20slang%3D%22en-US%22%3ERelationship%20between%20Azure%20Active%20Directory%20and%20Directory%20(Tenant%3F)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1605314%22%20slang%3D%22en-US%22%3E%3CP%3ESo%20I've%20read%20through%20this%20post%20but%20still%20slightly%20uncertain%20of%20the%20relationship%20(%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure%2Funderstanding-azure-account-subscription-and-directory%2Fm-p%2F34800%23M35%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure%2Funderstanding-azure-account-subscription-and-directory%2Fm-p%2F34800%23M35%3C%2FA%3E)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20see%20Azure%20AD%20is%20mentioned%20everywhere%20and%20I%20understand%20it's%20purpose.%20However%2C%20Microsoft%20has%20the%20option%20to%20Switch%20Directory%20and%20that%20basically%20takes%20me%20to%20a%20new%20Tenant%20under%20my%20account%20which%20has%20it's%20own%20Azure%20AD%20that%20is%20not%20connected%20to%20the%20other.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%2C%20is%20it%20that%20the%20Switch%20Directory%20option%20is%20just%20another%20way%20of%20saying%20%22Tenant%22%3F%20Was%20it%20that%20Microsoft%20ran%20out%20of%20words%20to%20call%20it%20so%20they%20just%20settled%20on%20Directory%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%20maybe%20I%20just%20need%20clarification%3A%3C%2FP%3E%3CP%3EIs%20each%20Directory%20it's%20own%20self-contained%20unit%20whose%20only%20relationship%20with%20other%20directories%20is%20that%20they%20are%20under%20the%20same%20account%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20a%20Directory%20really%20another%20name%20for%20Tenant%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhenever%20I%20research%20it%20and%20I%20see%20anything%20that%20says%20%22Directory%22%2C%20someone%20always%20mention%20Azure%20AD%20in%20their%20response%2Fanswer%2C%20but%20there%20seems%20to%20be%20some%20confusion%20there%2C%20or%20at%20least%2C%20it%20is%20confusing%20me.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1605314%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1607755%22%20slang%3D%22en-US%22%3ERe%3A%20Relationship%20between%20Azure%20Active%20Directory%20and%20Directory%20(Tenant%3F)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1607755%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F767643%22%20target%3D%22_blank%22%3E%40KemarB%3C%2FA%3E%26nbsp%3B%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20understand%20your%20confusion.%20I%20agree%20there%20are%20several%20%22terms%22%20in%20Azure%20that%20seem%20to%20overlap%20or%20could%20be%20synonyms.%20In%20addition%2C%20you%20might%20see%20these%20terms%20used%20inconsistently%20in%20the%20Portal%20UI%20or%20documentation.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20always%20try%20to%20approach%20it%20from%20the%20practical%20point%20of%20view%2C%20for%20example%3A%3C%2FP%3E%3CUL%3E%3CLI%3ECan%20I%20create%20a%20new%20Azure%20AD%20tenant%20and%20if%20yes%2C%20how%20is%20it%20related%20to%20my%20existing%20environment%3F%3C%2FLI%3E%3CLI%3ECan%20I%20create%20several%20directories%20under%20that%20tenant%3F%3C%2FLI%3E%3CLI%3ECan%20I%20have%20several%20domains%20under%20my%20tenant%3F%3C%2FLI%3E%3C%2FUL%3E%3CP%3EI%20like%20to%20use%20this%20article%20written%20for%20AAD%20developers%20as%20a%20reference%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fdevelop%2Fquickstart-create-new-tenant%23use-an-existing-tenant%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fdevelop%2Fquickstart-create-new-tenant%23use-an-existing-tenant%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20saw%20some%20confusing%20or%20even%20wrong%20replies%20in%20the%20%22linked%22%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure%2Funderstanding-azure-account-subscription-and-directory%2Fm-p%2F34800%23M35%22%20target%3D%22_self%22%3Etopic%3C%2FA%3E%26nbsp%3Blike%20someone%20claiming%20you%20can%20have%20several%20directories%20under%20one%20AAD%20tenant.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20see%20it%20this%20way%3A%20%3CSTRONG%3EAzure%20AD%20tenant%20%3D%20directory%3C%2FSTRONG%3E%2C%20and%20there%20is%20a%20strict%201%3A1%20relationship%20between%20them%20(you%20cannot%20create%20several%20directories%20under%20a%20tenant).%20Each%20tenant%20has%20it's%20globally%20unique%20'tenant%20ID'%20(in%20some%20places%20in%20the%20Portal%20referred%20as%20'directory%20ID'%2C%20but%20the%20ID%20is%20the%20same.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhen%20you%20use%20'Switch%20directories'%20option%20in%20the%20Portal%2C%20you%20are%20authenticating%20to%20a%20different%20AAD%20tenant%20(your%20account%20was%20invited%20as%20a%20guest%20there%20via%20Azure%20AD%20B2B%20Collaboration)%2C%20so%20you%20will%20see%20different%20subscriptions%20and%20resources%2C%20and%20have%20different%20permissions%2C%20when%20you%20do%20so.%20Since%20most%20organizations%20have%20one%20production%20tenant%20(but%20some%20like%20ISVs%20can%20have%20more)%2C%20you%20are%20switching%20to%20a%20different%20%22company%22.%20That's%20how%20I%20see%20it.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20can%2C%20however%2C%20have%20several%20domains%20under%20one%20tenant%20%2F%20directory.%20You%20always%20get%20a%20default%20one%20%3CEM%3E%7Bsomething%7D.onmicrosoft.com%3C%2FEM%3E%2C%20but%20you%20can%20onboard%20custom%20domains%20(like%20%3CEM%3Econtoso.com%3C%2FEM%3E)%20upon%20proving%20you%20own%20that%20domain.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1607760%22%20slang%3D%22en-US%22%3ERe%3A%20Relationship%20between%20Azure%20Active%20Directory%20and%20Directory%20(Tenant%3F)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1607760%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F767643%22%20target%3D%22_blank%22%3E%40KemarB%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ETo%20best%20of%20my%20understanding%2C%20you%20are%20correct%20-%20when%20switching%20directory%2C%20you%20are%20switching%20switching%20tenant%20i.e%20going%20from%26nbsp%3B%3CEM%3Ecompany1.onmicrosoft.com%20%3C%2FEM%3Eto%26nbsp%3B%3CEM%3Ecompany2.onmicrosoft.com%3C%2FEM%3E%20which%20are%20separate%2C%20distinct%20units%20that%20do%20not%20shared%20users%2Fresources%20etc.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Ffundamentals%2Factive-directory-whatis%23terminology%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Ffundamentals%2Factive-directory-whatis%23terminology%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20gives%20the%20definition%20of%20tenant%2Fdirectory.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CTABLE%3E%3CTBODY%3E%3CTR%3E%3CTD%3EAzure%20tenant%3C%2FTD%3E%3CTD%3E%3CP%3EA%20dedicated%20and%20trusted%20instance%20of%20Azure%20AD%20that's%20automatically%20created%20when%20your%20organization%20signs%20up%20for%20a%20Microsoft%20cloud%20service%20subscription%2C%20such%20as%20Microsoft%20Azure%2C%20Microsoft%20Intune%2C%20or%20Office%20365.%20An%20Azure%20tenant%20represents%20a%20single%20organization.%3C%2FP%3E%3C%2FTD%3E%3C%2FTR%3E%3C%2FTBODY%3E%3C%2FTABLE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CTABLE%3E%3CTBODY%3E%3CTR%3E%3CTD%3EAzure%20AD%20directory%3C%2FTD%3E%3CTD%3EEach%20Azure%20tenant%20has%20a%20dedicated%20and%20trusted%20Azure%20AD%20directory.%20The%20Azure%20AD%20directory%20includes%20the%20tenant's%20users%2C%20groups%2C%20and%20apps%20and%20is%20used%20to%20perform%20identity%20and%20access%20management%20functions%20for%20tenant%20resources.%3C%2FTD%3E%3C%2FTR%3E%3C%2FTBODY%3E%3C%2FTABLE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFor%20all%20intents%20and%20purposes%2C%20they%20are%20pretty%20much%20the%20same%20as%20far%20as%20I%20can%20determine.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHope%20this%20helps%2C%3C%2FP%3E%3CP%3EMark%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EEdit%20-%20just%20saw%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F10907%22%20target%3D%22_blank%22%3E%40David%20Pazdera%3C%2FA%3E%26nbsp%3Banswered%20a%20more%20informative%20response%20while%20I%20was%20typing%20this%20out%20-%20looks%20like%20I%20wasn't%20too%20far%20off%20the%20mark%20though%20%3A)%3C%2Fimg%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1613097%22%20slang%3D%22en-US%22%3ERe%3A%20Relationship%20between%20Azure%20Active%20Directory%20and%20Directory%20(Tenant%3F)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1613097%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F10907%22%20target%3D%22_blank%22%3E%40David%20Pazdera%3C%2FA%3E%26nbsp%3BThanks.%20That%20was%20really%20helpful.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1613102%22%20slang%3D%22en-US%22%3ERe%3A%20Relationship%20between%20Azure%20Active%20Directory%20and%20Directory%20(Tenant%3F)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1613102%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F383653%22%20target%3D%22_blank%22%3E%40HidMov%3C%2FA%3E%26nbsp%3BThanks.%20You%20were%20on%20point%20too%26nbsp%3B%3CIMG%20class%3D%22lia-deferred-image%20lia-image-emoji%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Fhtml%2Fimages%2Femoticons%2Fsmile_40x40.gif%22%20alt%3D%22%3Asmile%3A%22%20title%3D%22%3Asmile%3A%22%20%2F%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

So I've read through this post but still slightly uncertain of the relationship (https://techcommunity.microsoft.com/t5/azure/understanding-azure-account-subscription-and-directory/...)

 

I see Azure AD is mentioned everywhere and I understand it's purpose. However, Microsoft has the option to Switch Directory and that basically takes me to a new Tenant under my account which has it's own Azure AD that is not connected to the other.

 

So, is it that the Switch Directory option is just another way of saying "Tenant"? Was it that Microsoft ran out of words to call it so they just settled on Directory?

 

So maybe I just need clarification:

Is each Directory it's own self-contained unit whose only relationship with other directories is that they are under the same account?

 

Is a Directory really another name for Tenant?

 

Whenever I research it and I see anything that says "Directory", someone always mention Azure AD in their response/answer, but there seems to be some confusion there, or at least, it is confusing me.

4 Replies
Best Response confirmed by Blakemar (New Contributor)
Solution

Hi @Blakemar ,

 

I understand your confusion. I agree there are several "terms" in Azure that seem to overlap or could be synonyms. In addition, you might see these terms used inconsistently in the Portal UI or documentation.

 

I always try to approach it from the practical point of view, for example:

  • Can I create a new Azure AD tenant and if yes, how is it related to my existing environment?
  • Can I create several directories under that tenant?
  • Can I have several domains under my tenant?

I like to use this article written for AAD developers as a reference: https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-create-new-tenant#use-an-...

 

I saw some confusing or even wrong replies in the "linked" topic like someone claiming you can have several directories under one AAD tenant.

 

I see it this way: Azure AD tenant = directory, and there is a strict 1:1 relationship between them (you cannot create several directories under a tenant). Each tenant has it's globally unique 'tenant ID' (in some places in the Portal referred as 'directory ID', but the ID is the same.

 

When you use 'Switch directories' option in the Portal, you are authenticating to a different AAD tenant (your account was invited as a guest there via Azure AD B2B Collaboration), so you will see different subscriptions and resources, and have different permissions, when you do so. Since most organizations have one production tenant (but some like ISVs can have more), you are switching to a different "company". That's how I see it.

 

You can, however, have several domains under one tenant / directory. You always get a default one {something}.onmicrosoft.com, but you can onboard custom domains (like contoso.com) upon proving you own that domain.

Hi @Blakemar 

 

To best of my understanding, you are correct - when switching directory, you are switching switching tenant i.e going from company1.onmicrosoft.com to company2.onmicrosoft.com which are separate, distinct units that do not shared users/resources etc.

 

https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis#termino...

 

This gives the definition of tenant/directory. 

 

Azure tenant

A dedicated and trusted instance of Azure AD that's automatically created when your organization signs up for a Microsoft cloud service subscription, such as Microsoft Azure, Microsoft Intune, or Office 365. An Azure tenant represents a single organization.

 

Azure AD directoryEach Azure tenant has a dedicated and trusted Azure AD directory. The Azure AD directory includes the tenant's users, groups, and apps and is used to perform identity and access management functions for tenant resources.

 

For all intents and purposes, they are pretty much the same as far as I can determine.

 

Hope this helps,

Mark

 

Edit - just saw @David Pazdera answered a more informative response while I was typing this out - looks like I wasn't too far off the mark though :) 

@David Pazdera Thanks. That was really helpful.

@HidMov Thanks. You were on point too :smile: