title: How to restrict tenants in multitenant application with Azure AD authentication
body: <p>I'm currently developing a multitenant Angular SPA application that connects to multiple webAPI's in the backend and uses AzureAD authentication where each AD represents a tenant. </p>
  
  <p>Azure documentation on multitenancy points to an example applicaiton called <a href="https://docs.microsoft.com/en-us/azure/architecture/multitenant-identity/run-the-app" rel="noreferrer">Tailpsin.Surveys</a> which I was able to run after following the steps on the page. That application differs from my scenario as it is a WebApp no an SPA.</p>
  
  <p>In this webApp, during OpenId middlreware setup, an implementation of <code>OpenIdConnectEvents</code> is passed. 
  That implementation overrides <code>TokenValidated</code> method and blocks tenants that hadn't gone through signup before.</p>
  
  <p>That's what I'm trying to achieve in in my application, but would that mean that each and every WebAPI should always check for issuer claim on token to validate the tenant?</p>
  
  <p>That seems like something repetitive and could turn into a performance issue, I believe.</p>
  
  <p>Is there any configuration in Azure or some other ways of restricting access to your application to a set of defined tenants?</p>