Recipes

.NET — B2B SaaS (multi-tenant)

2 min read·Updated May 7, 2026

← All recipes · First time? Set up your app (60 seconds — keys + redirect URI)

An ASP.NET Core app where each customer is a tenant, users may belong to multiple tenants, and roles are scoped per tenant. Builds on the single-tenant recipe — read that first; this page only shows the deltas.

1. What you'll build#

A B2B SaaS .NET backend where the user signs in, picks a tenant (Authaz Sign-In handles this UI), and every endpoint reads tenant_id from the access token to scope its work — including authorization checks against Zeratul.

2. Application setup#

Create the app as multi-tenant, shared pool:

POST https://your-app.authaz.io/api/v1/applications
X-API-Key: mgmt_01h...
 
{
  "name": "my-saas",

Previous: .NET — first integration
Next: Tokens

var tenants = new TenantsApiClient(httpClientFactory, logger);
var tenant = await tenants.CreateAsync(new CreateTenantRequest { Name = "Acme Corp" });
 
var invitations = new InvitationsApiClient(httpClientFactory, logger);
await invitations.SendAsync(new SendInvitationRequest
{
    Email = "founder@acme.com",
    Roles = new[] { "admin" },
    TenantId = tenant.Id,
});

using Authaz.Sdk;
using Microsoft.AspNetCore.Authorization;
 
public sealed record TenantPermissionRequirement(string Resource, string Action)
    : IAuthorizationRequirement;
 
public sealed class TenantPermissionHandler(
    PermissionCheckApiClient authz,
    IHttpContextAccessor http)
    : AuthorizationHandler<TenantPermissionRequirement>
{
    protected override async Task HandleRequirementAsync(
        AuthorizationHandlerContext context,
        TenantPermissionRequirement requirement)
    {
        var sub = context.User.FindFirst("sub")?.Value;
        var tenantId = context.User.FindFirst("tenant_id")?.Value;
 
        if (!Guid.TryParse(sub, out var userId)) return;
        if (!Guid.TryParse(tenantId, out var tenantGuid)) return;
 
        var result = await authz.CheckAsync(new PermissionCheckRequest
        {
            UserId = userId,
            Permission = $"{requirement.Resource}:{requirement.Action}",
            TenantId = tenantGuid,
        });
 
        if (result.Allowed) context.Succeed(requirement);
    }
}

builder.Services.AddHttpContextAccessor();
builder.Services.AddScoped<PermissionCheckApiClient>();
builder.Services.AddScoped<IAuthorizationHandler, TenantPermissionHandler>();
 
builder.Services.AddAuthorizationBuilder()
    .AddPolicy("invoices:create", p =>
        p.Requirements.Add(new TenantPermissionRequirement("invoices", "create")))
    .AddPolicy("invoices:read", p =>
        p.Requirements.Add(new TenantPermissionRequirement("invoices", "read")));

public static class TenantContext
{
    public static (Guid UserId, Guid TenantId)? Resolve(ClaimsPrincipal user)
    {
        if (!Guid.TryParse(user.FindFirst("sub")?.Value, out var uid)) return null;
        if (!Guid.TryParse(user.FindFirst("tenant_id")?.Value, out var tid)) return null;
        return (uid, tid);
    }
}

app.MapPost("/invoices", (HttpContext ctx, CreateInvoiceRequest req) =>
{
    var ctxIds = TenantContext.Resolve(ctx.User);
    if (ctxIds is null) return Results.Forbid();
    var (userId, tenantId) = ctxIds.Value;
 
    // …create the invoice scoped to tenantId…
    return Results.Created($"/invoices/{Guid.CreateVersion7()}",
        new { userId, tenantId, req.Amount });
})
.RequireAuthorization("invoices:create");

app.MapGet("/team", async (HttpContext ctx, UsersApiClient users) =>
{
    var ids = TenantContext.Resolve(ctx.User);
    if (ids is null) return Results.Forbid();
    var (_, tenantId) = ids.Value;
 
    var team = await users.ListByTenantAsync(tenantId, pageSize: 50);
    return Results.Ok(team.Data);
})
.RequireAuthorization("invoices:read");

.NET — B2B SaaS (multi-tenant) - Authaz - Docs

.NET — B2B SaaS (multi-tenant)

1. What you'll build#

2. Application setup#

3. Install#

4. Configure#

5. Wire it up#

6. Read tenant from the access token#

7. Protect a tenant-scoped endpoint#

8. Common gotchas#

9. Next steps#