17. The computer storage media of claim 16 , wherein receiving the token comprises receiving a single sign-on (SSO) token.
16. One or more computer-readable storage media including computer-executable instructions that, when executed, cause at least one processor to conceal tenancy in a multi-tenant cloud service participating in a federated identity platform by: receiving a request for a document from a first entity by the cloud service, the request including an identifier associated with a second entity; redirecting the first entity to an identity provider for authentication; receiving a token from the identity provider indicating authentication of the first entity by the identity provider; comparing the identifier to a set of tenant identifiers each corresponding to one of a plurality of tenants to determine whether the second entity is one of the plurality of tenants; dynamically generating a fictitious document in response to the request after determining that the second entity is not one of the plurality of tenants; digitally signing the generated fictitious document with a certificate for the second entity; and sending the signed fictitious document to the first entity.