✅ You are a SaaS vendor or ISV and you create and publish apps that Azure AD customers can consume There are many valid scenarios for creating multi-tenant apps in your tenant, including

✅ Ask if the devs have implemented appropriate checks to prevent sign-ins from other tenants.

✅ Ask why the dev needs this to be a multi-tenant app? If the app is developed by devs in your org and is only meant for users in your own org. ✅ If the only option provided by the vendor is to create the app in your tenant, push for the vendor to allow you to create a single tenant app. Use the admin consent model to add the app to your tenant. ✅ If app gallery is not an option, request the vendor to create the app in their own tenant. ✅ If the app is not in the gallery, you as the customer can request the vendor to get their app listed on the Azure AD app gallery ✅ Add the app to your tenant from the Azure AD Application Gallery If the app is from a vendor/SaaS provider: So, what is the general rule of thumb that Azure AD admins and cybersecurity teams should follow?

⚠️ I'll repeat ➟ your CA policies do not apply to users signing into your multi-tenant app in their own tenant. The policy only applies to users in your tenant. If you create a multi-tenant app in your corporate tenant and apply a conditional access policy. When an app is created as a multi-tenant app, ANY user from ANY Azure AD tenant can visit the app's url and sign in. Examples of such apps are ServiceNow and SalesForce. Multi-tenant apps are meant for ISVs and SaaS vendors to create an instance of an app in 'their own tenant'. In some instances, it was the devs in the org asking for this, in other instances it was the application vendor. I've recently noticed that Azure AD admins are being asked to create multi-tenant apps in their corporate tenant.

Mfa setup microsoft authenticator