Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.

1.2. Tenants, Directories, and Identity Objects

💡 First Principle: Every identity needs a home that some authority controls. In Microsoft's cloud, that home is the tenant — one organization's dedicated instance of Microsoft Entra ID — and everything you'll administer on this exam is an object inside it or a policy scoped to it.

Get the container model wrong and nothing downstream makes sense: you'll confuse tenants with subscriptions, guests with members, and app blueprints with app instances. Get it right and questions about scoping — "which users does this policy affect?" — become easy, because you'll always ask which tenant, which objects first. The mental model to carry: a tenant is like a legal jurisdiction. It has its own citizens (users), organizations (groups), registered property (devices, apps), and laws (policies). Other jurisdictions' citizens can visit (guests), but they remain citizens of their homeland.

⚠️ Common Misconception: A Microsoft Entra tenant and an Azure subscription are the same boundary. They are not: the tenant is the identity boundary; a subscription is a billing and resource container that trusts exactly one tenant, while one tenant can back many subscriptions. Exam stems that mix "move the subscription to another tenant" with identity questions are testing this line.

See how it connects
Alvin Varughese
Written byAlvin Varughese
Founder18 professional certifications