What is a tenant identifier?¶
A tenant identifier is a value used to distinguish one organisation’s cloud environment from another.
It may help show which organisational account, directory or workspace generated a record.
What this means in practice¶
Organisations may have several tenants for production, testing, subsidiaries, acquisitions or different regions.
Display names can also change, while the underlying tenant ID remains stable.
Guest access can create activity in another organisation’s tenant while the user signs in with their home account.
Where records come from several organisations, tenant IDs help separate which environment logged each event.
Where domains or organisation names overlap, the tenant ID prevents confusion between similarly named environments. This is especially important after mergers, rebranding or migration.
What this may show¶
Investigators should preserve the tenant ID, organisation name, domain, service, region and relevant account identifiers.
Also establish whether a tenant was migrated, merged or renamed. Historical records may continue to use an older label.
Where a user appears as a guest, preserve both the home identity and guest-object identifiers. The two records may represent the same person in different tenants but are not interchangeable.
What this does not show on its own¶
The dangerous assumption is that a familiar organisation name is enough to identify the correct cloud environment.
The tenant ID does not identify the person or physical location. It identifies the cloud environment.
What to do next¶
Check whether the user belonged to one tenant or several at the relevant time.
Do not confuse the tenant that hosted the resource with the identity provider that authenticated the user.
Key takeaway
A tenant identifier shows which organisational cloud environment recorded the activity, so use it to separate accounts, guests and resources across linked organisations.