Skip to main content

ADR-009: Shared Entra External ID Tenant Across Products

Date: 2026-07-07
Status: Accepted
Deciders: Pete Carroll

Context​

As Waypoint and Relay are built alongside RoundTrip, a decision must be made about authentication infrastructure. Should each product have its own Entra External ID CIAM tenant, or should all three products share the existing roundtripapp tenant?

This decision affects the user experience (one login vs multiple), operational complexity, and the integration story for the Traxs One Suite.

Decision​

All three Traxs products share the existing roundtripapp Entra External ID CIAM tenant. Each product gets its own app registration within the shared tenant.

Tenant: roundtripapp.onmicrosoft.com (08f09e72-40f3-4443-8fec-3a77c4c0d1ee)

App Registrations:
  RoundTrip Web Client   ← existing, af3f62ac-bf1d-4f66-a205-56622fa5ef22
  RoundTrip API          ← existing
  Waypoint Web Client    ← new, created when Waypoint is built
  Waypoint API           ← new, created when Waypoint is built
  Relay Web Client       ← new, created when Relay is built
  Relay API              ← new, created when Relay is built
  b2c-extensions-app     ← existing, shared across all products

One set of credentials. One user account. Access to whichever products the tenant has subscribed to is controlled by app roles.

Alternatives Considered​

Option A — Separate Entra Tenant Per Product​

Each product gets its own Entra External ID tenant (roundtripapp, waypointapp, relayapp).

Rejected because:

  • Users need separate credentials for each product — terrible UX for a suite
  • Three separate tenants means three separate user provisioning flows
  • The b2c-extensions-app custom attributes (TenantId) would need to be replicated
  • Three times the Entra operational complexity
  • Cross-product SSO becomes a significant engineering problem

Option B — Shared Entra Tenant (selected)​

All products share roundtripapp tenant. New app registrations added per product.

Selected because:

  • One login works across the entire Traxs suite — seamless user experience
  • User provisioning happens once — granting Waypoint access is a role assignment, not a new account
  • The existing b2c-extensions-app TenantId attribute works across all products
  • Significant reduction in auth infrastructure and operational complexity
  • Consistent with the "one platform" positioning of the Traxs Suite

Implementation​

App Roles Per Product​

Each product defines its own app roles within the shared tenant:

RoundTrip:  TenantAdmin, Dispatcher, Technician, BillingStaff, ReadOnly
Waypoint:   WaypointAdmin, WaypointViewer, WaypointHR (future)
Relay:      RelayAdmin, RelayViewer, RelaySales (future)

A user can hold roles across multiple products simultaneously. A RoundTrip TenantAdmin automatically gets Waypoint access when they subscribe — the provisioning job assigns WaypointAdmin in the same Entra user account.

TenantId Linking​

The existing extension_74ae24d66fa9411095712cfddae0db04_tid custom attribute on the Entra user links to the Traxs Group TenantId. This TenantId is the same across all products — Waypoint and Relay use the same TenantId as RoundTrip to look up tenant data in their respective databases.

Token Scopes​

Each product's API defines its own scope:

RoundTrip: api://c7f83f45-27cd-4bef-a6dc-f81d98077144/roundtrip.access
Waypoint:  api://[waypoint-app-id]/waypoint.access   ← new
Relay:     api://[relay-app-id]/relay.access          ← new

MSAL in each frontend requests the appropriate scope for its product.

Consequences​

What becomes easier:

  • Single sign-on across the entire Traxs suite with no extra engineering
  • User provisioning is a single flow — one Entra invitation grants access to all products the tenant subscribes to
  • The existing GraphUserService and provisioning infrastructure works for all products
  • Consistent auth debugging — one tenant to check, one set of credentials to rotate

What becomes harder:

  • App registration management gets more complex as products are added — must keep track of which registration belongs to which product
  • App role sprawl — as each product adds roles, the tenant gets more complex
  • If a product is sold or licensed separately, the auth must be disentangled from the shared tenant

Mitigation: Document all app registrations and their purposes in the Infrastructure Reference. Keep a strict naming convention for app registrations (RoundTrip Web Client, Waypoint Web Client, Relay Web Client).