Guide: Multi-Tenant Architecture

Multi-Tenant Architecture: What You Should Know

Multi-tenant architecture is becoming increasingly popular in SaaS circles due to its ability to save resources, accelerate development times, and address multiple use cases. Let’s take a closer look at what it’s all about and learn about the main benefits.

What Is Multi-Tenant Architecture?

Multi-tenant architecture is the use of a single logical software application or service to serve multiple customers. In this model, each customer is referred to as a tenant. You can provide a tenant with the ability to customize certain parts of the application, like business rules, users, displays, and database schemas. However, a tenant typically cannot customize the application code. 

With multi-tenant architecture, several application instances operate in a shared environment. Each instance can serve one or more tenants. This works by running tenants on the same physical infrastructure, while keeping them logically isolated. All tenants share some aspects of the application—such as the business logic and central configuration—while having their own separate data, customizations, and user management, isolated from all other tenants.

This is part of an extensive series of guides about IaaS.

In this article:

Why Is Multi-Tenant Architecture Important?

Multi-tenant architecture is a foundational technology behind cloud computing. Cloud providers use multi-tenancy to manage multiple customers on the same infrastructure, and this is the basis for the economic benefits and elasticity of the public cloud. Private clouds can also make use of multi-tenancy, to share the same resources between multiple users, projects, or organizational units.

The cost effectiveness made possible by multi-tenancy is possibly the biggest driver encouraging enterprises to adopt multi-tenant architectures. 

Another important driver is scalability. A single platform that serves multiple public cloud customers or multiple units within an organization makes it possible to operate at a very large scale. This means that cloud users have access to virtually unlimited resources at the click of a button. If multi-tenancy was inefficient or cumbersome, cloud computing would not be possible.

Tenancy Models for SaaS: Single Tenant vs Multi-Tenant

When designing a SaaS application, providers must choose their tenancy model: single or multi-tenant. The tenancy model has major implications for a SaaS provider, including the resources needed to serve the application, scalability, and operational complexity.

A single-tenant architecture provides a single instance of the software or infrastructure to one customer. This instance includes all customer data and is physically isolated from other customers. Customer data and operations are never shared with other application instances. 

In this model, the provider manages the software instance on dedicated infrastructure, typically with its own database, while providing the user a high level of flexibility over software and hardware customizations. 

A single-tenancy model typically provides more control and improved security for the user. However, it also increases complexity for users, because they need to configure their instance and have more limited scalability options. This model is also likely to be much more expensive for the user, while software functionality remains the same.

A multi-tenant architecture uses a single instance of the software application to serve multiple customers. All tenants share common features like security, business logic, and resource management. At the same time, each tenant is isolated from the others to protect its private data and settings. Customer data is kept confidential by permissions mechanisms that ensure each customer can only see their own data. 

In this model, providers save costs, and users also receive important benefits such as scalability, automated setup and ease of use. At the same time, multi-tenancy naturally creates greater security risks, as well as other concerns such as performance and reliability. The client cannot always predict in advance how their tenant will perform and whether they will be impacted by resource constraints of the provider or the activities of other tenants.

Learn More: Multi-tenant SaaS

Multi-Tenant Architecture: Pros and Cons

Here are key advantages of multi-tenant architecture for SaaS:

  • Lower costs— Multi-tenancy enables the serving of multiple tenants using a single instance, helping support the infrastructure. Since tenants share responsibilities over software maintenance, data center operations, and infrastructure, the ongoing costs are lower. It allows providers to offer SaaS software for a predictable annual or monthly subscription price.\
  • Scalability and improved productivity for tenants— A multi-tenant architecture enables tenants to scale on demand. New users can access the same software instance, typically incurring an incremental subscription rate increase. Tenants do not need to manage software or infrastructure, freeing up their time for other important tasks.
  • Customization without coding— Most SaaS multi-tenancy vendors provide a high level of customization to ensure each tenant customer can customize the application according to specific business needs. It differs from custom development by minimizing risks and reducing work time and costs.
  • Continuous, consistent updates and maintenance — Multi-tenant software providers are responsible for patches and updates. They apply new features and fixes without any effort required on the customer’s part. Unlike a single-tenant architecture that requires providers to update every software instance, multi-tenancy involves one update. 

Here are notable drawbacks of multi-tenant architecture for SaaS:

  • Greater security risk—a single-tenant architecture isolates security events to a single customer. Multi-tenant architecture, however, does not allow this isolation because multiple tenants share resources. As a result, the risk factor increases, and a security event impacting one tenant may harm other customers. Any information hosted on shared databases, for example, may expose all data if one customer is compromised.
  • Noisy neighbors – Since multi-tenancy enables tenants to share resources, they also share the load. If one customer suddenly increases the load, this impacts other tenants sharing the same resource. 

Multi-Tenant Authentication

One of the main challenges when building multi-tenant applications is managing user identities. Multi-tenant applications require managing users in the context of their tenants, in such a way that each user belongs to a tenant:

  • Each user has credentials provided by their own organization/tenant.
  • Users should be able to access their own data, but not other tenants’ data.
  • Organizations can register applications and assign specific application roles to their members.

The authentication process is as follows:

  • Users log in to the application using their existing organizational credentials. Commonly, this is done with single sign on (SSO) so that users do not need to create a new user profile for the multi-tenant application.
  • All users from the same organization belong to the same tenant.
  • When a user logs in, the application identifies the relevant tenant and provides access to it.

The authorization process is as follows:

  • When the application authorizes a user’s request (e.g., to view a resource), it must consider the user’s tenant.
  • Users can have assigned roles in the application (e.g., standard user or administrator). The customer organization, not the SaaS provider, should manage these role assignments.

Learn more: Multi-Tenant Authentication

How to Improve Multi-Tenancy Security

Use the following best practices to ensure a multi-tenant architecture is secure:

  • Effective Governance and Compliance Processes – Before you implement multi-tenancy, establish a privacy, security, and compliance policy that protects your tenant’s corporate and intellectual property (in a public cloud) or properly isolates tenants according to their sensitivity (in a private cloud).
  • Enable Process Auditing – Ensure that independent parties can audit the compliance of IT systems, especially those hosting applications and tenant data. Ensure everything complies with government regulations, industry standards, and individual company policies.
  • Verify Cloud Provider Access Controls – Cloud providers must have robust systems for controlling employee access to resources that store, transmit, and run customer applications and data, and must be able to demonstrate to tenants that their process is effective.
  • Ensure Effective Separation – A cloud provider must enforce virtual infrastructure encryption policies and access controls to partition cloud deployments from each other and effectively isolate tenant data.
  • Monitor Data Sharing – Discover and monitor permission settings applied to shared files, including those shared to users outside your organization via web links. Employees might share sensitive files via cloud-based email, file sharing, and cloud storage platforms like Google Drive and Dropbox.
  • Implement Data Loss Prevention (DLP) – DLP can ensure that data stored in a tenant is not lost or stolen by attackers. It can also prevent downloads of sensitive data to personal devices, as well as intentional or unintentional data sharing and exposure.

Multi-Tenant User Management With Frontegg

In a nutshell, Frontegg’s PLG-centric and end-to-end user management platform is multi-tenant by design. 

By developing the platform to the essential requirements of the B2B SaaS, we know that each tenant has its own configurations, user sets, and security settings. This is why Frontegg allows each environment to hold segregated sets of tenants, assign users to each one of them, and hold a separate configuration for each one of them in a way that doesn’t affect the neighboring tenants in any way or form.

In the complex B2B world, each customer requires fine grained control on each configuration. That requires professional products to keep pace with these requirements and develop a multi-tenant capable infrastructure from day 1. Frontegg just makes it easier.

See Our Additional Guides on Key IaaS Topics

Together with our content partners, we have authored in-depth guides on several other topics that can also be useful as you explore the world of IaaS.

Cloud Deep Learning

Authored by Run.AI

AWS High Availability

Authored by NetApp

AWS Autoscaling

Authored by Spot.Io