Skip to main content

COMMAND CENTER / PLATFORM: Cross-product identity strategy — does adding a second Traxs product hit the same Entra collision issues?

info

This is information from TRA-401

Overview​

Captured 2026-08-09, cross-product concern surfaced while working through TRA-384/389 (RoundTrip's Entra identity collision and domain-redirect issues). Not RoundTrip-specific — this is about how identity should work across the whole Traxs platform as Waypoint and Relay come online.

The concern​

RoundTrip currently uses its own dedicated Entra External ID tenant (roundtripapp.onmicrosoft.com). We've spent this weekend discovering real, non-obvious failure modes tied to that single-tenant model — an email/domain that already has any Entra identity (guest or member) can't cleanly get a second one, and a verified business domain can get redirected to real M365 credentials instead of RoundTrip's own login flow.

If Waypoint and Relay each get their own separate Entra tenant, or all three share one, the same class of problem could show up again — but now across products, not just within RoundTrip. Concretely: if someone signs up for Waypoint first, then later wants RoundTrip too, does their existing identity cause a collision or redirect, the same way support@traxsgroup.com/hello@traxsgroup.com did this weekend? Same question in reverse for RoundTrip-first, Waypoint-later.

Why this matters now, not just eventually​

This is exactly the kind of foundational architecture decision that's much cheaper to get right before Waypoint has real users than to migrate later. Given RoundTrip already has two real, confirmed bugs in this space (TRA-384, TRA-389), there's real, hard-won evidence to design from rather than guessing blind.

Scope — not decided, needs real Command Center planning​

Real options to weigh eventually, not chosen here: one shared Entra tenant across all three products (simpler, but inherits RoundTrip's exact collision/redirect problems at platform scale) vs. separate tenants per product (avoids that, but raises its own question — does a Traxs One customer using multiple products want one login across all of them, or is per-product login actually fine?).

TRA-384, TRA-389 (the RoundTrip-specific instances this concern is generalized from). Belongs in the real Command Center planning session — TRA-225 already has substantive scoping material worth starting from.

Metadata​

Pull requests​

Comments​

  • GitHub integration:

    This comment thread is synced to a corresponding GitHub issue. All replies are displayed in both locations.