Cloud Transformation

Multitenant SaaS on Azure

Many tenants on shared app tiers in two regions, each with its own database in elastic pools.

Front Door routes each tenant's users to the nearest healthy region. Application Gateway, App Service and AKS are shared; isolation comes from Entra ID sign-in, tenant settings in App Configuration and a database per tenant in Azure SQL elastic pools, provisioned from templates.

HTTPSnearest healthy regiontenant's own databasenew tenantcreateMicrosoft AzureGlobalRegion 1Region 2 · same stackShared services and tenant dataTenants' usersAzure Front Doornearest healthy regionAzure DNScustom domainsMicrosoft Entra IDsign-in per tenantApplication Insightstenant as a dimensionCost Managementcost per tenantAzure Policyresidency, encryptionApplication Gatewaywith WAFAzure App Servicebusiness logicAKSdata accessAzure AI Searchtenant-filteredAzure Managed Rediskeys per tenantApplication Gatewaywith WAFAzure App Servicebusiness logicAKSdata accessApp Configurationsettings per tenantAzure Key Vaultkeys, secretsSQL elastic poolsa database per tenantARM templatestenant provisioningTenant onboardingself-service

Point at a component to light its links; select it for what it does here and the practice that makes it right on Azure.

When to use it

  • A software vendor moving from one deployment per customer to one platform
  • Tenants that need their data kept apart, sometimes in a chosen region
  • Fast onboarding: a new tenant in minutes, without a project

How NGT delivers it

Built from code, reviewed at a gate by an NGT architect, and handed over with runbooks your team can run.

Cloud Transformation