Building automations that operate across multiple client tenants has a problem before you write a single line of code: you don't always have access to two environments to test them. And testing in production is not an option.

In this session, I'll show how to build a lab that reproduces a SecOps ↔ client architecture using a single test tenant. We start from a real case — an identity management automation deployed across client tenants — and build the scenario step by step: logical separation of the two roles, multi-tenant app registration, admin consent flow, managed identities, and Microsoft Graph permissions.

The important part comes next: we go over which behaviors this setup validates reliably, and which it doesn't. Simplification is useful, but you need to know exactly where it's going to bite you once you move to the real environment.

Built for anyone working with Azure and identity who wants to experiment without depending on extra licenses or environments they don't control.

What attendees will take away:
A replicable lab they can set up that same afternoon, with minimal resources.
Clear criteria for what this simulation validates — and what actually requires a real environment.
The specific mistakes I made building it, so you don't have to repeat them.

You don't always have two tenants to test a multi-client automation, and testing in production isn't an option. I'll show you how to build a single-tenant lab that simulates that architecture, what it actually validates, and the mistakes I made setting it up.