Entra Multi-Tenant App Mistakes Every SaaS Builder and Admin Should Know, with Kelvin Tegelaar

Entra.Chat

0:00

-43:24

Entra Multi-Tenant App Mistakes Every SaaS Builder and Admin Should Know, with Kelvin Tegelaar

Must watch before you build your next multi-tenant app, or consent to one in your tenant.

Merill Fernando

Oct 31, 2026

Most SaaS vendors connect to your tenant with one multitenant app and one credential, shared by every customer. Kelvin Tegelaar, founder of CyberDrain and creator of CIPP (used by well over 10,000 MSPs), sees it from both sides, and his verdict is blunt: “This app is dangerous, period.”

Recorded on 14 October 2026, one day before the ConnectWise Cloud Backup app’s credential was used to sign in to customer tenants (173 confirmed by Huntress).

Key takeaways

The risk: one app, every tenant

One app registration, a service principal in every tenant. The credentials sit on the vendor’s app registration, so one leaked secret or certificate works in every tenant that consented, with whatever application permissions you granted. For MSP tools, GDAP widens it to every customer behind the partner.
You can’t put Conditional Access on a vendor’s app. Conditional Access for workload identities covers single-tenant apps only. Watch vendor apps’ sign-ins, ask vendors how they protect their credentials, and know where the Enabled for users to sign-in? switch is so you can disable an app fast.

Fix the credentials

Retire client secrets; let certificates rotate themselves. Prefer managed identity or federation; otherwise use short-lived certificates. CIPP’s last 30 days and are replaced every two weeks with Microsoft Graph addKey/removeKey, not by granting the app Application.ReadWrite.All.
Turn on app management policies. Block new client secrets and cap credential lifetimes. The tenant default policy is off until you enable it.
Lock your app’s service principals. Builders: keep app instance property lock on (the default for new apps since June 2026), so customer tenants can’t add their own credentials to your app.

Fix the architecture

Build one app per customer tenant. A leak in tenant A then stays in tenant A. It costs some engineering; one central app is “choosing convenience”, which is fine only if you choose it knowingly.
Keep the apps you ship out of your corporate tenant. Separate tenants for corporate, Azure and the apps you publish, all secured to the same baseline. Decide early: an app registration can’t move between tenants.

Watch the full conversation for how Kelvin built CIPP out of spite, the vendor mistakes he sees most, and why a standard pen test won’t find any of this.

Sponsored by:

Know what’s in your tenant, and keep watching it

Every risk above lives in your own tenant: multitenant vendor apps with powerful permissions, client secrets and certificates that live for years, and app management policies nobody turned on. Maester, the free, open-source security test framework for Microsoft 365, finds them, with tests for long-lived app certificates, expiring credentials, privileged permissions nobody uses and app management restrictions.

Maester Cloud keeps watching after the first scan:

Continuous monitoring: scheduled runs, each one diffed against the last, with drift alerts sent from your own Microsoft 365 mailbox.
Assign each failed test to its owner and link a ticket.
Track the work until it’s fixed: new failures, fixes since the last run and accepted risks, each pinned to a date and run ID.
Every tenant in one place, switching between customers without signing in again. Unlimited users and tenants.

Self-hosted in your own Azure subscription for $99 a month or $1,188 a year, or through Azure Marketplace on your Azure invoice.

Try the live demo

Subscribe with your favorite podcast player or watch on YouTube

About Kelvin Tegelaar

Kelvin Tegelaar is the founder of CyberDrain and the creator of CIPP, the CyberDrain Improved Partner Portal, an open-source, sponsor-funded tool that MSPs use to manage their customers’ Microsoft 365 tenants. He owns and is CTO of Lime Networks, an MSP in the Netherlands, and has been a Microsoft MVP for eight years. A system administrator rather than a developer by trade, he built CIPP in PowerShell and has blogged at CyberDrain.com for years about automating Microsoft 365 for MSPs.

GitHub - https://github.com/KelvinTegelaar

CyberDrain - cyberdrain.com

Related Entra.Chat Episodes

Stolen Tokens, Agents and Universal CAE: What Global Secure Access Adds to Entra ID (mentioned at 35:27) - https://entra.news/p/stolen-tokens-agents-and-universal
Stop the Bleeding: Cleaning Up Apps, Secrets and Consent in Microsoft Entra - https://entra.news/p/stop-the-bleeding-cleaning-up-apps
Your AI Coding Agent Is Creating Secrets You Don’t Know About - https://entra.news/p/your-ai-coding-agent-is-creating