Edit

Share via

Related resources for multitenancy

  • Article

This article provides a set of links and resources for architects and developers of multitenant solutions.

Architectures for multitenant applications

The following articles provide examples of multitenant architectures on Azure.

Architecture Summary Technology focus
Multitenant software as a service (SaaS) on Azure Reference architecture for a multitenant SaaS scenario on Azure, which is deployed in multiple regions Web
Use Application Gateway Ingress Controller (AGIC) with a multitenant Azure Kubernetes Service (AKS) cluster Example for how to implement multitenancy with AKS and AGIC Kubernetes
All multitenant architectures Lists all the architectures that include multitenancy Multiple

Cloud design patterns

The following cloud design patterns are frequently used in multitenant architectures.

Pattern Summary
Deployment Stamps pattern Deploy multiple independent copies (or scale units) of application components, including data stores.
Federated Identity Delegate authentication to an external identity provider.
Gatekeeper Protect applications and services by using a dedicated host instance that serves as a broker between clients and the application or service, validates and sanitizes requests, and passes requests and data between them.
Queue-Based Load Leveling Use a queue that serves as a buffer between a task and a service that it invokes in order to smooth intermittent heavy loads.
Sharding Divide a data store into a set of horizontal partitions or shards.
Throttling Control the consumption of resources that an application instance, an individual tenant, or an entire service uses.

Antipatterns

Consider the Noisy Neighbor antipattern, in which the activity of one tenant can negatively affect another tenant's use of the system.

Microsoft Azure Well-Architected Framework

If you design a SaaS, use the Microsoft Azure Well-Architected Framework workload for SaaS to get actionable architectural guidance that's specific to SaaS solutions.

The entirety of the Well-Architected Framework is important for all solutions, including multitenant architectures, but pay special attention to the Reliability pillar. The nature of cloud hosting results in applications that are often multitenant, use shared platform services, compete for resources and bandwidth, communicate over the internet, and run on commodity hardware. This environment increases the likelihood that both transient and more permanent faults will occur.

Multitenant architectural guidance

  • Architect multitenant solutions on Azure (video): This video describes how to design, architect, and build multitenant solutions on Azure. If you build a SaaS product or another multitenant service, there's a lot to consider when you plan for high performance, tenant isolation, and deployment management. This session is aimed at developers and architects who build multitenant or SaaS applications, including startups and ISVs.

  • Azure Friday - Architect multitenant solutions on Azure (video): This video from Azure Friday describes how to design, architect, and build multitenant SaaS solutions on Azure.

  • Accelerate and de-risk your journey to SaaS (video): This video provides guidance on how to transition to the SaaS delivery model, whether you're lifting and shifting an existing solution from on-premises to Azure, considering a multitenant architecture, or modernizing an existing SaaS web application.

Resources for Azure services

Use the following resources to help you build multitenant architectures on Azure.

Governance and compliance

  • Organize and manage multiple Azure subscriptions: It's important to consider how you manage your Azure subscriptions and how you allocate tenant resources to subscriptions.

  • Cross-tenant management experiences: As a service provider, you can use Azure Lighthouse to manage resources for multiple customers from within your own Microsoft Entra tenant. Many tasks and services can be performed across managed tenants by using Azure delegated resource management.

  • Azure-managed applications: In a managed application, the resources are deployed to a resource group that the publisher of the app manages. The resource group is present in the consumer's subscription, but an identity in the publisher's tenant has access to the resource group.

Compute

  • Best practices for cluster isolation in AKS: AKS provides flexibility in how you can run multitenant clusters and can isolate resources. To maximize your investment in Kubernetes, you must first understand and implement AKS multitenancy and isolation features. This best practices article focuses on isolation for cluster operators.

  • Best practices for cluster security and upgrades in AKS: As you manage clusters in AKS, workload and data security is a key consideration. When you run multitenant clusters by using logical isolation, securing resource and workload access is crucial.

Networking

  • Azure Private Link Service explanation and demos from provider (SaaS ISV) and consumer perspectives: A video that looks at the Azure Private Link service feature that enables multitenant service providers (such as independent software vendors building SaaS products). This solution enables consumers to access the provider's service using private IP addresses from the consumer's own Azure virtual networks.
  • TCP Proxy Protocol v2 with Azure Private Link Service—Deep Dive: A video that presents a deep dive into TCP Proxy Protocol v2, which is an advanced feature of the Azure Private Link service. It's useful in multitenant and SaaS scenarios. The video shows you how to enable Proxy Protocol v2 in the Azure Private Link service. It also shows you how to configure an NGINX service to read the source private IP address of the original client, rather than the NAT IP, to access the service via the private endpoint.
  • Using NGINX Plus to decode Proxy Protocol TLV linkIdentifier from the Azure Private Link service: A video that looks at how to use NGINX Plus to get the TCP Proxy Protocol v2 TLV from the Azure Private Link service. The video shows how you can then extract and decode the numeric linkIdentifier, also called LINKID, of the private endpoint connection. This solution is useful for multitenant providers who need to identify the specific consumer tenant from which the connection was made.
  • SaaS Private Connectivity pattern: An example solution that illustrates one approach to automate the approval of private endpoint connections, by using Azure Managed Applications.

Web

  • Claims-based routing for SaaS solutions: This article describes the usage of a reverse proxy to facilitate tenant routing and mapping requests to tenants, enhancing the management of back-end services in SaaS solutions.

Storage and data

Messaging

Identity

Analytics

IoT

AI and machine learning

Community content

Kubernetes

  • Three tenancy models for Kubernetes: Kubernetes clusters are typically used by several teams in an organization. This article explains three tenancy models for Kubernetes.

  • Understand Kubernetes multitenancy: Kubernetes isn't a multitenant system out of the box. It requires custom configuration. This article explains Kubernetes multitenancy types.

  • Kubernetes multitenancy best practices guide: Kubernetes multitenancy is a topic that organizations are increasingly interested in as their Kubernetes usage spreads out. However, because Kubernetes isn't explicitly a multitenant system, it can be challenging to design a multitenant Kubernetes implementation. This article describes these challenges, how to overcome them, and some useful tools for Kubernetes multitenancy.

  • Capsule: Kubernetes multitenancy made simple: Capsule helps to implement a multitenancy and policy-based environment in your Kubernetes cluster. It isn't a platform as a service (PaaS) offering, but instead is a microservices-based ecosystem with a minimalist design approach, using only upstream Kubernetes.

  • Crossplane: The cloud-native control plane framework: Crossplane enables you to build control planes for your own solution by using a Kubernetes-based approach.

Contributors

Microsoft maintains this article. The following contributors wrote this article.

Principal authors:

To see nonpublic LinkedIn profiles, sign in to LinkedIn.