Q: Microsoft Identity AzureAD ASP.NET Core for Two Tenants only We have an internal business Blazor Server app that is to be used by two Azure AD Tenants only. We have the following appsettings.json file. When the user authenticates we want to verify that the ID Token is from either of these two tenantid as a requirement to be Authorized. We can currently see the issuer in the initial ID Token context.User.Claims received after authenticating on either of the two Tenants. We tried to add the ValidIssuers list to the TokenValidationParameters. However, it remains authorization from any tenant is allowed, instead of just the two.
Now we are searching for a clue about where and how to include the issuer requirement for authentication. I have searched the Internet for a while now, and am unable to find an example specific enough to be confident about doing it correctly. I imagine this is simple for some people. Any direction is most appreciated. Best regards, Ranny
{
  "AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "Domain": "xxxxxxxx",
    "TenantId": "organizations",
    "ClientId": "xxxxxxxxxxxxxxxx",
    "CallbackPath": "/signin-oidc",
    "SignedOutCallbackPath": "/signout-callback-oidc"
  },
  "AllowedIssuers": "xxxxxxxxxxxxxxxxxxxxxxxxxx,yyyyyyyyyyyyyyyyyyyyyyyyyy",
  "AllowedHosts": "*"
}

Startup.cs section:
services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(Configuration.GetSection("AzureAd"));

services.Configure<OpenIdConnectOptions>(options =>
    options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
    {
        ValidateIssuer = true,
        ValidIssuers = new List<string>()
        {
            @"https://login.microsoftonline.com/xxxxxxxxxxxxxxxxxxxxxxxxxx/v2.0",
            @"https://login.microsoftonline.com/yyyyyyyyyyyyyyyyyyyyyyyyyy/v2.0"
        }
    });


A: We can restrict the users to specific/multiple tenants in following ways.
1. Restrict Access by tenant location
While creating the user in an tenant, you can specify the region that he is not allowed to access any subscription and groups belongs to that tenant and region you selected by selecting "Yes" to Block Sign In option.

2) Restrict Access by user domain id

*

*Go to [Azure Active directory portal] - The Azure Active Directory admin center dashboard appears.

*In the left pane, select  Azure Active Directory. The Azure Active Directory overview page appears.

*On the Overview page, select Tenant Properties

*There you can give/restrict access to all the resources in that tenant for the user based on user's domain id (for ex: user@mxxxxx.onmicrosoft.com)


After doing these operations on tenant restrictions to users, if user tries to access applications in which he/she doesn't have permissions then they will get this kind of

For more information, hope this Microsoft documentation for tenant restrictions to users will helps you.
