Audit Log Service  ·  View 19 of 40  ·  4 · Data

Where the Tenant Boundary Sits

The answer to the seventh core question, given as a split rather than a principle.

Editable source SVG draw.io All views
486 tenants — shared containers, tenant as the first partition key Shared Container one locked policy tenant / date / class prefix is the boundary Encryption Scope per tenant, per blob Per-Tenant KEK Managed HSM Query Tenant Filter from identity, not input 14 tenants — dedicated accounts where residency or contract requires it Storage Account one per tenant Own Region residency assignment Own Locked Policy own retention terms Customer-Held Key phase 3 Never shared, on either side of that line Hash Chain one per tenant Proof Path reveals no other tenant Ingest Quota largest is 35% Index Partition pruned before scan Residual risk, accepted and monitored Shared Policy Error one config, 486 tenants Small-Object Tail compaction required Ciphertext Only misroute yields nothing wraps segment DEK Where the Tenant Boundary Sits in Storage Data store Application we own Security / platform Risk / gap Opportunity synchronous Question 7 answered as a split, not a principle. Physical separation for 500 tenants would multiply locked-policy and lifecycle configuration by 500 and shatter the long tail into objects too small to be economic; a shared container with a per-tenant encryption scope makes a misrouted read return bytes the reader holds no key for. v 1.0 · owner Data & AI Global Practice · date 2026-09

Question 7 answered

  • 486 tenants share containers with tenant as the first partition key, a per-tenant encryption scope and a per-tenant key in the HSM. 14 tenants with residency or contractual requirements get a dedicated storage account.
  • Physical separation for all 500 would multiply locked-policy, key and lifecycle configuration by 500 and shatter the long tail into objects too small to be economic — the smallest tenants would produce segments of a few hundred kilobytes an hour.
  • The shared arrangement makes a misrouted read return bytes the reader holds no key for, which is a structural answer rather than a filtering one.

What is never shared

  • The hash chain, the proof path, the ingest quota and the index partition are per tenant on both sides of the split. A proof reveals no other tenant's existence, and one tenant provably cannot exhaust shared ingest capacity.
  • Residency and retention can diverge per tenant in the dedicated group without changing anything for the other 486.

Residual risk

  • One misconfigured locked policy on a shared container affects 486 tenants. Mitigated by policy-as-code, a CI scan over the IaC and a daily assertion that every container's policy is locked and its retention has not decreased — accepted, not eliminated.
  • Small-object cost in the long tail is real and is handled by chain-preserving compaction rather than by longer seal windows, which would weaken the 60 s guarantee.
◀  Retention and Tiering All views Synchronous Ingest  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source19-tenancy-in-storage