Building Multi-Tenant SaaS with .NET and Azure

1. Shared Database, Shared Schema

All tenants share tables with a TenantId discriminator column. Simplest and most cost-effective model. Perfect for platforms using PostgreSQL databases, which offer excellent performance for large tenant counts.

2. Shared Database, Separate Schemas

Single database with schema-per-tenant (PostgreSQL schemas or SQL Server schemas). Moderate isolation.

3. Separate Databases (Database-per-Tenant)

Each tenant gets a dedicated database. Maximum isolation and customization.

Tenant Resolution Middleware

A critical component of any multi-tenant platform is proper tenant identification. In a modern .NET platform, middleware provides the ideal point to implement this logic.

// Tenant identification strategies
public class TenantResolutionMiddleware
{
    public async Task InvokeAsync(HttpContext context, ITenantService tenantService)
    {
        // Strategy 1: Subdomain (tenant1.app.com)
        var host = context.Request.Host.Host;
        var tenantId = ExtractTenantFromSubdomain(host);

        // Strategy 2: Header (X-Tenant-ID)
        if (string.IsNullOrEmpty(tenantId))
            tenantId = context.Request.Headers["X-Tenant-ID"];

        // Strategy 3: JWT Claim
        if (string.IsNullOrEmpty(tenantId) && context.User.Identity?.IsAuthenticated == true)
            tenantId = context.User.FindFirst("tenant_id")?.Value;

        // CRITICAL: Never trust client-sent tenant IDs for data access
        // Always validate against authenticated user's allowed tenants
        var tenant = await tenantService.GetAndValidateTenantAsync(tenantId, context.User);
        context.Items["TenantId"] = tenant.Id;
    }
}

Global Query Filters (EF Core)

Automatically filter all queries by tenant to prevent data leaks:

public class ApplicationDbContext : DbContext
{
    private readonly ITenantService _tenantService;

    public ApplicationDbContext(DbContextOptions options, ITenantService tenantService)
        : base(options)
    {
        _tenantService = tenantService;
    }

    protected override void OnModelCreating(ModelBuilder modelBuilder)
    {
        // Apply global query filter to all tenant-scoped entities
        foreach (var entityType in modelBuilder.Model.GetEntityTypes())
        {
            if (typeof(ITenantEntity).IsAssignableFrom(entityType.ClrType))
            {
                var method = typeof(ApplicationDbContext)
                    .GetMethod(nameof(SetGlobalQueryFilter), BindingFlags.NonPublic | BindingFlags.Static)
                    ?.MakeGenericMethod(entityType.ClrType);

                method?.Invoke(null, new object[] { modelBuilder, _tenantService });
            }
        }
    }

    private static void SetGlobalQueryFilter<T>(ModelBuilder modelBuilder, ITenantService tenantService)
        where T : class, ITenantEntity
    {
        modelBuilder.Entity<T>().HasQueryFilter(e => e.TenantId == tenantService.GetCurrentTenantId());
    }
}

// Entity interface
public interface ITenantEntity
{
    string TenantId { get; set; }
}

// Example entity
public class Order : ITenantEntity
{
    public int Id { get; set; }
    public string TenantId { get; set; } // Automatically filtered
    public decimal Amount { get; set; }
}

Database-per-Tenant with Connection String Resolution

public class TenantDbContextFactory
{
    private readonly ITenantService _tenantService;
    private readonly IConfiguration _configuration;

    public ApplicationDbContext Create()
    {
        var tenantId = _tenantService.GetCurrentTenantId();
        var connectionString = GetConnectionStringForTenant(tenantId);

        var optionsBuilder = new DbContextOptionsBuilder<ApplicationDbContext>();
        optionsBuilder.UseNpgsql(connectionString);

        return new ApplicationDbContext(optionsBuilder.Options);
    }

    private string GetConnectionStringForTenant(string tenantId)
    {
        // Option 1: Dedicated database per tenant
        return $"Host=postgres.app.com;Database=tenant_{tenantId};Username=app;Password=...";

        // Option 2: Azure SQL Elastic Pool with databases
        // return $"Server=tcp:app.database.windows.net;Database=tenant_{tenantId};...";

        // Option 3: Lookup from tenant configuration table
        // var tenant = await _tenantRepo.GetAsync(tenantId);
        // return tenant.ConnectionString;
    }
}

Azure SQL Elastic Pools

Share compute resources across multiple tenant databases while maintaining isolation.

Azure AD B2C for Multi-Tenant Auth

Manage tenant users with Azure AD B2C: custom policies, social login, MFA, user flows.

• • Store tenant context in JWT claims
• • Support invite-based user provisioning
• • Enable SSO for enterprise tenants
• • Pricing: First 50K MAU free, then $0.00325/MAU

Application Insights Per-Tenant Telemetry

// Add tenant context to all telemetry
services.AddApplicationInsightsTelemetry();
services.AddSingleton<ITelemetryInitializer, TenantTelemetryInitializer>();

public class TenantTelemetryInitializer : ITelemetryInitializer
{
    private readonly ITenantService _tenantService;

    public void Initialize(ITelemetry telemetry)
    {
        if (telemetry is ISupportProperties propertiesTelemetry)
        {
            propertiesTelemetry.Properties["TenantId"] = _tenantService.GetCurrentTenantId();
            propertiesTelemetry.Properties["TenantName"] = _tenantService.GetCurrentTenantName();
        }
    }
}

// Query in Azure portal:
// requests | where customDimensions.TenantId == "tenant-123" | summarize count() by bin(timestamp, 1h)

Which multi-tenancy model should I choose?

Choose based on scale and isolation needs: Shared database/shared schema for 100-10,000 tenants (lowest cost), shared database/separate schemas for 10-1,000 tenants (moderate isolation), separate databases for enterprise tenants (maximum isolation). Most successful SaaS platforms use hybrid approach: shared for SMB, dedicated for enterprise.

How do I handle tenant-specific customizations?

Use configuration-driven approach: store tenant preferences in metadata tables, use feature flags for per-tenant features, implement plugin architecture for custom business logic. Avoid tenant-specific code branches. Instead, use strategy pattern with dependency injection to swap implementations per tenant.

What are the security best practices?

Critical practices: (1) Never trust client-sent tenant IDs, always derive from authenticated identity, (2) Use EF Core global query filters to prevent cross-tenant data leaks, (3) Implement tenant context middleware, (4) Encrypt sensitive data with tenant-specific keys, (5) Audit cross-tenant operations, (6) Test for tenant isolation with automated tests, (7) Implement rate limiting per tenant.

How much does it cost to run on Azure?

Small SaaS (100 tenants): $500-1,500/month. Medium SaaS (1,000 tenants): $3,000-8,000/month. Large SaaS (10K+ tenants): $20K-50K+/month. Key is proper tier selection and autoscaling. Use Azure Cost Management for monitoring and reserved instances for 40% savings on predictable workloads.

Can I migrate from single-tenant to multi-tenant?

Yes, phased approach: (1) Add tenant context to tables, (2) Implement tenant resolution middleware, (3) Update code to filter by tenant ID, (4) Consolidate databases with data migration, (5) Test for data leaks, (6) Run parallel for validation. Expect 3-6 months for production migration depending on codebase size.