We’re developing multitenant Angular Web App which uses Azure DocumentDb as a storage. Documents from all tenants of the app stored in the same collection and distinguished by tenantId attribute of the document. We will have middle tier .NET service which holds master key to DocumentDb and exposes REST API endpoints for CRUD operations by Web App. Users of the Web App is authenticated by oAuth providers (Google, Facebook, Microsoft). What is the best practice for securing tenants data so users of one tenant cannot access data from other tenants?