AI Agent Orchestration Platform  ·  View 30 of 32  ·  6 · Assurance and delivery

Multi-Tenant Isolation

Four layers of isolation, what each one actually prevents, and what the pooled tier still accepts.

Editable source SVG draw.io All views
Layer 1 · Identity and admission Request scoping Tenant Mapping Entra tenant to id Tenant Claim on every token APIM Product per tenant key Request Quota RPS and TPM Layer 2 · Runtime Pooled tier Shared Worker Pool tenant-scoped run Concurrency Cap per tenant Session per Run destroyed after Dedicated tier Dedicated Env own Container Apps Private Endpoints tenant VNet Layer 3 · Data and secrets Stores Cosmos Partition tenant_id key SQL Row Security session context Search Index one per tenant ADLS Container one per tenant Credentials Tenant Key Vault own CMK Rotation Schedule 90 days Layer 4 · Telemetry, cost and audit Segregation Log Scoping tenant dimension ADX Row Policy tenant filter Cost Attribution tag on every call Audit Partition export per tenant Noisy Neighbour pooled tier only Cross-Tenant Read tested each release scopes every query bounds impact denies by default CMK Multi-Tenancy — Four Layers of Isolation Security / platform Interface / broker Decision point Application we own Data store Risk / gap synchronous failure / alternate The pooled tier accepts a bounded noisy-neighbour risk in exchange for cost. The dedicated tier removes it and is priced accordingly. v 1.0 · owner Data & AI Global Practice · date 2026-08

Decisions

  • Isolation is layered rather than singular: identity, runtime, data and telemetry each enforce it independently, so one failure is not a breach
  • Two tiers: pooled for cost, dedicated for tenants with a contractual or regulatory isolation requirement
  • Tenant quotas and budgets are configurable and enforced at admission, so isolation covers noisy neighbours as well as data

Scope of isolation

  • Runtime execution, persistent state, memory, logs, metrics, secrets and tool access
  • One search index, one ADLS container and one Key Vault with its own customer-managed key per tenant
  • Cross-tenant read attempts are a tested case in every release, not an assumption

Accepted risk

  • The pooled tier accepts a bounded noisy-neighbour effect in exchange for cost; concurrency caps bound it, they do not remove it
  • Index-per-tenant does not scale past a few hundred tenants on one search service; beyond that a service-per-cohort model is required
  • A shared worker process is a shared blast radius if the container runtime is ever escaped; that is why sensitive tools go to the isolated session pool
◀  Identity and Delegation All views Failure Modes and Residual Risk  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-08 · 32 views · Microsoft Azure30-multi-tenant-isolation