Unverified50% confidenceFactExact time
In multi-tenant mode, when the tenant placeholder in the authorization endpoint is set to common, Microsoft automatically directs the user to the sign-in page of their own tenant based on the email they enter, which is itself a tenant discovery mechanism provided by the platform.
1
Sources
50%
Confidence
Long-term
Relevance
10/26/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedThe application can determine the sign-in path based on the user's email domain: if the domain belongs to a configured Entra tenant, the user is directed to that enterprise's SSO flow; otherwise it falls back to generic Microsoft OAuth sign-in.69% similarUnverifiedA common approach to multi-tenant RAG is to attach `tenant_id` metadata to each document chunk in the vector store and enforce tenant filtering during retrieval to avoid cross-tenant recall; at the same time, permission checks are performed at the application layer to ensure users can only access the knowledge base of the tenant they belong to.67% similarUnverifiedWhen an agent is deployed as part of a tenant, it will have its own dedicated mailbox address and can act on its own behalf66% similarUnverifiedThe cache key of a multi-tenant product must be derived from the tenant, the model, and the prompt version simultaneously.65% similarUnverifiedGoogle usually requires email verification before login, while the OIDC implementations of some self-hosted or niche providers allow users to set any unverified email; this inconsistency in verification policies across providers gives attackers an opportunity.65% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1100352API
curl https://kongchang.com/api/v1/knowledge/claims/1100352MCP
get_claim(id=1100352)