Skip to content

Registering and managing external tenants in CertifyClouds

PRO / ENTERPRISE Feature

External tenant support requires a PRO or ENTERPRISE license.

This page covers the CertifyClouds side of external tenant setup. The steps are the same whether the tenant is an Azure AD B2C tenant or an Entra External ID tenant, so both are documented here once.

The Azure-portal half differs between the two and lives on its own page:

  • Azure AD B2C — directory switching, and the two-credential cap on B2C service principals
  • Entra External ID — the standard App registrations blade

Do that side first. You need the tenant's directory GUID, its domain, and the client ID and secret of the service principal you created there before anything below will work.

Registering a tenant, editing it, and running discovery all need an admin account. Other users see the tenant list read-only.

Register the tenant

Step 1: Open the form

  1. Go to Tenants in the left-hand navigation and open the External tab
  2. Click Add Tenant

The modal is titled Register External Tenant.

Step 2: Enter the details

Field Description
Tenant Type Azure AD B2C or Entra External ID (CIAM)
Tenant ID (GUID) The external tenant's directory GUID
Tenant Domain e.g., yourcompany.onmicrosoft.com
Display Name Friendly name, such as Production External ID
Description Optional
Client ID The service principal's application ID
Client Secret The service principal's secret

Pick the Tenant Type first. It decides how CertifyClouds talks to the tenant, and it is what the External tab uses to label the tenant afterwards.

Step 3: Configure discovery

The same modal has a Discovery Settings section.

Option Description Recommended
Environment Production, Staging or Development Production
Auto-discover apps Scan for App Registrations on a schedule Enabled
Discovery interval How often that scan runs Every 24 hours

Step 4: Test and register

  1. Click Test Connection
  2. Expected: Connection successful - Found organization: [Tenant Name]
  3. Click Register Tenant

If the test fails, fix it before registering. A failing connection means the credentials, the permissions, or the admin consent are wrong, and discovery will fail the same way.

Step 5: Run discovery

  1. Click Run Discovery on the tenant's card
  2. Expand the card to see the discovered App Registration credentials

Configuring alerts

Expiry alerts for external tenants are ordinary alert rules.

  1. Go to Settings → Alerts
  2. Click Create Alert Rule and choose type Expiry
  3. Set Source to External tenant credentials (B2C / External ID) (PRO)
  4. Set the threshold in days before expiry
  5. Choose email or webhook delivery
  6. For owner-scoped delivery, select application owners, and confirm the tenant's service principal has User.Read.All with admin consent

One Expiry rule covers both expiring and already-expired credentials; you do not need a second rule for each. See Alerts for the full rule model.

Security best practices

  1. Use a dedicated service principal in each external tenant, not a shared one
  2. Grant least privilege. Application.Read.All is enough for discovery. Add Application.ReadWrite.All only if you want CertifyClouds to rotate credentials in that tenant, and never grant both
  3. Review admin consent regularly on the permissions you did grant
  4. Rotate the service principal secret before it expires, or let CertifyClouds do it for you. See Rotating CertifyClouds' Own Credentials
  5. Monitor sign-in and audit logs in the external tenant
  6. Separate environments with distinct service principals where practical