Home > Multi-tenant administration > Identity providers across tenants
Identity providers across tenants
Last updated: 11/3/2026Cadence: Quarterly
Subscription model: Multi-tenant subscriptions
Roles: Tenant Admin (TA), Service Account Owner (SAO)
Last verified: 2026-05
| Initial | Recurring | |
|---|---|---|
| Estimated time | 1 hr | 30 min |
Benefits:
- Prevents duplicate license assignments by inconsistent IdP configuration
- Documents per-tenant SAO and IdP-recovery URL in one runbook
- Coordinates IdP-side claim/group changes across all tenants in a single window
Goal
To keep pooled entitlement counts accurate across tenants, use the same identity provider (IdP) and subject-claim mapping under every tenant in a multi-tenant subscription—a user identified consistently across tenants is one license, not several (see Subscription and entitlement sharing). The quarterly review confirms IdP consistency, that the SAO/recovery URL is documented per tenant, and that any IdP-side changes are coordinated across all tenants.
Tasks
| Task | TA | AA | DA | AuA | SAO |
|---|---|---|---|---|---|
| Verify all tenants on the subscription use the same IdP and the same subject-claim mapping | ✓ | ||||
| Document the SAO and IdP-recovery URL per tenant in your central operations runbook | ✓ | ✓ | |||
| Synchronize IdP group / claim changes across all tenants in a coordinated change window | ✓ |
References
Tags: #quarterly #multi_tenant #idp #sao #recovery