Authenticate an SPA application / users from one tenant to another ( Multitenant )

Question

Authenticate an SPA application / users from one tenant to another ( Multitenant )

Ashwin Sidharthan 20

Hey ,

I am bit lost with the whole process of getting the cross tenant/multi tenant scenario to get working. Basically my scenario is that I have an SPA on a B2C tenant ( Tenant A ) and I need to call an API on another tenant B2B ( Tenant B ). Is this achievable?

Below are the steps that I have done

MS Admin center in Tenant B - create a multitenant org and add the Tenant ID of Tenant A
MS Admin center in Tenant A - join a multitenant org and add Tenant ID of Tenant B

With the above I am able to share users across the tenants

The part which is unclear is , how does my SPA app on Tenant A authenticate to the exposed scopes to call the Web API on the Tenant B. I am unable to grant API access across the tenant. I have tried to add the client ID of the SPA app to the Web API app, but gives me errors. Is there a proper documentation around this?

Thanks,
Ash

Accepted answer

0 additional answers

Your answer

Answer 1

Kancharla Saiteja 3,945 Microsoft External Staff

Hi @Ashwin Sidharthan,

Based on your query, here is my understanding: you would like to add tenant API exposed API in tenant B application.

Tenant A: Create an app registration as multi-tenant application in tenant A (eg: TenantAapp) and expose it as an API (api://app-id/app.permissiom). You can use the following document: Configure an application to expose a web API.

Tenant B:

Try to consent that TenantAapp multi-tenant application using a user of Tenant B, so that the application gets added to Tenant B as a service principal.
Once the application TenantAAPI gets added to Tenant B, you should be able to see its entry under the Enterprise Registration section.
Create another App Registration in Tenant B (eg: TenantBApp).
In the API Permissions section of TenantBApp, you can add a permission: Add a Permission --> Select an API --> APIs my Organization Uses --> here search for the api of tenant A i.e TenantAapp
Once you find the TenantAapp, add its exposed permission which is app.read as it would be listed there.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly "upvote it". If you have extra questions about this answer, please click "Comment".

Kancharla Saiteja 3,945 Reputation points Microsoft External Staff

2025-05-05T08:52:19.2733333+00:00

Hi @Ashwin Sidharthan,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Ashwin Sidharthan 20 Reputation points

2025-05-05T10:13:33.7466667+00:00

The consent option works well, thanks.

Question on what does the option of joining/creating a multi tenant set up from the admin center do?
Kancharla Saiteja 3,945 Reputation points Microsoft External Staff

2025-05-05T10:30:51.1+00:00

Hi @Ashwin Sidharthan,

Thanks for your response,

Multi-tenant organization works when different organizations would like to collaborate to access the resources. In your scenario of working with an application in two different tenants, you do not need any set up of multi organization set up. Here is the Microsoft document which helps you in understanding multi organization configuration: Plan for multitenant organizations in Microsoft 365.

Let me if you have any further queries.
Ashwin Sidharthan 20 Reputation points

2025-05-05T12:20:53.2166667+00:00

Thanks.

For the scenario of importing the app to another tenant, when we start to introduce user roles. How does it work? As Tenant A can be a completely different organization and if I have logic in my code to validate roles, the role claims can be added by the other Tenant A by adding users as they please. How should the Authorization flow be best designed in this case?
Kancharla Saiteja 3,945 Reputation points Microsoft External Staff

2025-05-05T12:36:00.3366667+00:00

Hi @Ashwin Sidharthan,

Azure AD B2C directly does not support B2C roles. In case if you would like to try adding app roles, please go through this thread: Assign App Roles to AD Users in AD B2C.

Share via

Authenticate an SPA application / users from one tenant to another ( Multitenant )

0 additional answers

Your answer