AvailableToOtherTenants is a directory or cloud application setting that marks an app registration as usable by users or administrators from other tenants. It controls whether external organisations can consent to or access the application in a multi-tenant model, affecting how sign-in, permissions and tenant boundaries are enforced.
How AvailableToOtherTenants Shapes Multi-Tenant App Reach
AvailableToOtherTenants is not just a label on an app registration, it is a tenancy boundary decision. When enabled, the application can be discovered and consented to by principals outside the home tenant, so the control influences who may even begin an authorization journey.
That makes the setting important in any multi-tenant design that uses Entra-style app registrations or similar directory controls. It determines whether the application is intended for a single organisation, a broader partner ecosystem, or a public-facing integration surface.
Consent, Sign-In, and Boundary Enforcement
The setting interacts with consent flows, token issuance, and how the directory interprets external access. If the app is available to other tenants, external admins or users may be able to grant consent subject to their own tenant policies, which means the trust boundary is shared rather than purely internal.
This matters because the same application can behave differently across tenants even when the code is unchanged. Organisational policy, admin consent restrictions, and conditional access in the external tenant can all affect whether access is permitted, but the app registration setting determines whether cross-tenant use is possible at all.
For background on the wider control environment around identity and access decisions, see NIST Cybersecurity Framework 2.0 and NIST SP 800-53 Rev 5 Security and Privacy Controls.
Why the Setting Matters for Tenant Trust
AvailableToOtherTenants is a governance setting because it changes which organisations can establish an authenticated relationship with the application. That makes it relevant to partner integrations, SaaS distribution, and any scenario where administrators need a deliberate decision about whether an external tenant should be allowed to participate.
Misconfiguring it can create the wrong exposure pattern. If an internal app is exposed as multi-tenant, external tenants may be able to request access paths that the publisher did not intend; if a genuinely shared app is kept single-tenant, onboarding friction and broken partner flows are the likely result.
In practice, the setting should be understood alongside least-privilege design and boundary verification. NIST Cybersecurity Framework 2.0 and NIST Privacy Framework both reinforce the need to align access decisions with the intended trust relationship.
Operational Checks Before You Enable Cross-Tenant Access
Before making an application available to other tenants, organisations should confirm the app owner, the intended audience, the consent model, and the expected data paths. The key question is whether cross-tenant access is a product requirement or an accidental exposure of an internal application.
Teams should also validate how external tenants will govern consent, how app roles and permissions are exposed, and whether the app’s sign-in experience is compatible with partner tenancy policies. In many environments, the safest default is to keep the app single-tenant unless a deliberate business need exists.
NIST Cybersecurity Framework 2.0 supports the ownership and review discipline behind that decision, while NIST SP 800-53 Rev 5 Security and Privacy Controls gives a control lens for access enforcement, configuration management, and auditability.
Risk and Threat Considerations
When an app is available to other tenants, the main risk is unintended trust expansion. A mis-set registration can allow external organisations to reach an application that was meant to stay internal, or to establish consent relationships that broaden the attack surface across tenants.
Failure mechanism: The application is published with a cross-tenant trust boundary that is broader than intended, and external consent or sign-in becomes possible where the publisher expected isolation.
Impact: Unauthorized exposure, partner tenant confusion, excessive permission grants, and a larger blast radius if the application or its delegated permissions are later abused.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | Tenancy scope must reflect the app's intended audience and trust boundary. |
| PR.AA-01 — Identity Management, Authentication, and Access Control | The setting directly affects who can authenticate and obtain access across tenants. | |
| Recommendation — Document whether the app is internal, partner-facing, or multi-tenant before enabling cross-tenant access. Align app registration settings with the intended authentication and access model. | ||
| NIST SP 800-53 Rev 5 | AC-3 — Access Enforcement | Cross-tenant access is fundamentally an access-enforcement decision for the application. |
| CM-6 — Configuration Settings | The setting is a configuration choice that changes the application's exposure boundary. | |
| Recommendation — Enforce tenant-scoped access rules so only intended external tenants can use the app. Review and approve the app's tenant-availability setting as a controlled configuration. | ||
Practitioner Guidance
Why practitioners should care: Treat this setting as an access-policy decision, not a convenience toggle. The right value depends on whether the application is truly intended for a multi-tenant audience and whether external consent is part of the approved operating model.
Governance implication: Ownership should sit with the application team and the identity governance function together, because the change affects registration policy, consent expectations, and cross-tenant trust boundaries.
Practitioner takeaway: Default to the narrowest tenancy scope that satisfies the use case, then expand only when the business need for external tenant access is explicit and documented.