Hi All, is it possible to use different Azure Entra ID Tenants for authenticating different workspaces?

Multiple Azure Entra ID Tenants for Authentication GoodData authentication operates at the organization level, not the workspace level — so you cannot directly assign different identity providers to different workspaces. However, there is a way to support multiple Azure Entra ID (formerly Azure AD) tenants within a single organization using the Multiple OIDC (MOIDC) feature. How it works With MOIDC, you can register multiple OIDC providers (including multiple Azure Entra ID tenants) for your organization. GoodData routes each user to the correct provider based on their email domain suffix. [MOIDC Overview] For example: •

user@tenant-a.com

→ Azure Entra ID Tenant A •

user@tenant-b.com

→ Azure Entra ID Tenant B Each identity provider must have at least one identifier (email domain) registered, and users are routed accordingly at login time. [MOIDC Setup] Azure-specific configuration When using Azure Entra ID as your OIDC provider, note that Azure uses

oid

instead of

sub

for user identification. You'll need to configure

customClaimMapping

accordingly when registering the provider:

"customClaimMapping": {
   "sub": "oid"
}

[MOIDC Configuration] Setting it up 1. Contact GoodData support to enable the MOIDC feature and provide your current IdP identifiers. 2. Once enabled, use the

/api/v1/entities/identityProviders

API to register each Azure Entra ID tenant as a separate OIDC provider with its own

identifiers

(email domains),

oauthClientId

,

oauthClientSecret

, and

oauthIssuerLocation

. Key limitation Routing is based on email domain, not workspace. Users from a specific email domain will always be authenticated by the same provider regardless of which workspace they access. If you need strict per-workspace isolation at the authentication level, that is not supported by the current design. 👍 0 button 👎 0 button ℹ️ Tip: Mention @kapa.ai in the thread for follow-ups. 👀 Our Support team monitors all messages and will jump in if needed., with interactive elements

@kapa.ai Is this possible on the Professional Tier of GoodData Cloud?

Thinking completed No, this is not available on the Professional tier. Federated Identity Management—which includes the Multiple OIDC (MOIDC) feature required to support multiple identity providers or tenants—is available only as part of the Enterprise tier [Federated Identity Management]. 👍 0 button 👎 0 button ℹ️ Tip: Mention @kapa.ai in the thread for follow-ups. 👀 Our Support team monitors all messages and will jump in if needed.