Edit

Resources for architects and developers of multitenant solutions

  • Article

Architectures for multitenant applications

The following articles provide examples of multitenant architectures on Azure.

Architecture Summary Technology focus
Multitenant SaaS on Azure Reference architecture for a multitenant SaaS scenario on Azure, which is deployed in multiple regions Web
Use Application Gateway Ingress Controller with a multi-tenant Azure Kubernetes Service Example for implementing multitenancy with AKS and AGIC Kubernetes
All multitenant architectures Lists all the architectures that include multitenancy Multiple

Cloud design patterns

The following cloud design patterns are frequently used in multitenant architectures.

Pattern Summary
Deployment Stamps pattern Deploy multiple independent copies (scale units) of application components, including data stores.
Federated Identity Delegate authentication to an external identity provider.
Gatekeeper Protect applications and services, by using a dedicated host instance that acts as a broker between clients and the application or service, validates and sanitizes requests, and passes requests and data between them.
Queue-Based Load Leveling Use a queue that acts as a buffer between a task and a service that it invokes, in order to smooth intermittent heavy loads.
Sharding Divide a data store into a set of horizontal partitions or shards.
Throttling Control the consumption of resources that are used by an instance of an application, an individual tenant, or an entire service.

Antipatterns

Consider the Noisy Neighbor antipattern, in which the activity of one tenant can have a negative impact on another tenant's use of the system.

Microsoft Azure Well-Architected Framework

While the entirety of the Azure Well-Architected Framework is important for all solutions, pay special attention to the Resiliency pillar. The nature of cloud hosting leads to applications that are often multitenant, use shared platform services, compete for resources and bandwidth, communicate over the internet, and run on commodity hardware. This increases the likelihood that both transient and more permanent faults will arise.

Multitenant architectural guidance

  • Architecting multitenant solutions on Azure (video): This video discusses how to design, architect, and build multitenant solutions on Azure. If you're building a SaaS product or another multitenant service, there's a lot to consider when you plan for high performance, tenant isolation, and to manage deployments. This session is aimed at developers and architects who are building multitenant or SaaS applications, including startups and ISVs.
  • Azure Friday - Architecting multitenant solutions on Azure (video): This video from Azure Friday discusses how to design, architect, and build multitenant software-as-a-service (SaaS) solutions on Azure.
  • Accelerate and De-Risk Your Journey to SaaS (video): This video provides guidance for transitioning to the software as a service (SaaS) delivery model - whether you're starting by lifting-and-shifting an existing solution from on-premises to Azure, considering a multitenant architecture, or looking to modernize an existing SaaS web application.

Resources for Azure services

Governance and compliance

  • Organizing and managing multiple Azure subscriptions: It's important to consider how you manage your Azure subscriptions, as well as how you allocate tenant resources to subscriptions.
  • Cross-tenant management experiences: As a service provider, you can use Azure Lighthouse to manage resources, for multiple customers from within your own Microsoft Entra tenant. Many tasks and services can be performed across managed tenants, by using Azure delegated resource management.
  • Azure Managed Applications: In a managed application, the resources are deployed to a resource group that's managed by the publisher of the app. The resource group is present in the consumer's subscription, but an identity in the publisher's tenant has access to the resource group.

Compute

Networking

  • Azure Private Link Service explanation and demos from provider (SaaS ISV) and consumer perspectives: A video that looks at the Azure Private Link service feature that enables multitenant service providers (such as independent software vendors building SaaS products). This solution enables consumers to access the provider's service using private IP addresses from the consumer's own Azure virtual networks.
  • TCP Proxy Protocol v2 with Azure Private Link Service—Deep Dive: A video that presents a deep dive into TCP Proxy Protocol v2, which is an advanced feature of the Azure Private Link service. It's useful in multitenant and SaaS scenarios. The video shows you how to enable Proxy Protocol v2 in the Azure Private Link service. It also shows you how to configure an NGINX service to read the source private IP address of the original client, rather than the NAT IP, to access the service via the private endpoint.
  • Using NGINX Plus to decode Proxy Protocol TLV linkIdentifier from the Azure Private Link service: A video that looks at how to use NGINX Plus to get the TCP Proxy Protocol v2 TLV from the Azure Private Link service. The video shows how you can then extract and decode the numeric linkIdentifier, also called LINKID, of the private endpoint connection. This solution is useful for multitenant providers who need to identify the specific consumer tenant from which the connection was made.
  • SaaS Private Connectivity pattern: An example solution that illustrates one approach to automate the approval of private endpoint connections, by using Azure Managed Applications.

Web

  • Claims based routing for SaaS solutions: This article discusses the usage of a reverse proxy to facilitate tenant routing and mapping requests to tenants, enhancing the management of backend services in SaaS solutions.

Storage and data

Messaging

Identity

Analytics

IoT

AI/ML

Community content

Kubernetes

  • Three Tenancy Models For Kubernetes: Kubernetes clusters are typically used by several teams in an organization. This article explains three tenancy models for Kubernetes.
  • Understanding Kubernetes Multi Tenancy: Kubernetes is not a multitenant system out of the box. While it's possible to configure multitenancy, this can be challenging. This article explains Kubernetes multitenancy types.
  • Kubernetes Multi-Tenancy – A Best Practices Guide: Kubernetes multitenancy is a topic that more and more organizations are interested in as their Kubernetes usage spreads out. However, since Kubernetes is not a multitenant system per se, getting multitenancy right comes with some challenges. This article describes these challenges and how to overcome them as well as some useful tools for Kubernetes multitenancy.
  • Capsule: Kubernetes multi-tenancy made simple: Capsule helps to implement a multitenancy and policy-based environment in your Kubernetes cluster. It is not intended to be yet another PaaS, instead, it has been designed as a micro-services-based ecosystem with the minimalist approach, leveraging only on upstream Kubernetes.
  • Loft: Add Multi-Tenancy To Your Clusters: Loft provides lightweight Kubernetes extensions for multitenancy.
  • Crossplane: The cloud native control plane framework: Crossplane enables you to build control planes for your own solution, by using a Kubernetes-based approach.

Contributors

This article is maintained by Microsoft. It was originally written by the following contributors.

Principal authors:

To see non-public LinkedIn profiles, sign in to LinkedIn.