Microsoft tenant lookup and search

Q: How do I find the tenant ID for a domain?

Search for the domain. The site shows its tenant ID, the tenant's name and every other domain in the tenant.

Q: Which Microsoft endpoints reveal tenant information?

Several Microsoft endpoints reveal tenant information, most without signing in. OpenID discovery, Office's federation provider and the Access Control Service metadata give the tenant ID (the last no longer lists the tenant's domains). The Azure Resource Manager subscription endpoint names a subscription's tenant. GetUserRealm gives the sign-in type, federation host and brand name. Autodiscover GetFederationInformation lists the domains in a tenant. Microsoft Graph's tenant information calls give the tenant's name and default domain but need a token from any tenant. A domain's DKIM selector record in DNS names its tenant, and an onmicrosoft name's MX record shows whether that tenant exists.

Q: Is the Azure tenant ID the same as the Microsoft 365 tenant ID?

Yes, for work and school accounts. Azure and Microsoft 365 use one Microsoft Entra ID tenant, so it has a single ID (the Directory ID in the Azure portal).

Q: Where does the data come from?

Tenant details come from some of Microsoft's public endpoints. The domains checked come from web crawls and other domain lists, plus each tenant's own domain list. No accounts or user data are involved.

Enter a domain to see its tenant ID and every other domain in its tenant, or search tenants by organization name, part of a domain, tenant name (contoso.onmicrosoft.com) or federation host.

Try microsoft.com, contoso, okta

Domains checked: 991,171,079
Tenants found: 18,761,573
Domains in tenants: 46,130,721

Questions

How do I find the tenant ID for a domain?

Search for the domain above. You'll see its tenant ID, the tenant's name and every other domain in the tenant. To look it up yourself, see the endpoints below.

Which Microsoft endpoints reveal tenant information?

Several Microsoft endpoints reveal tenant information. Most need no sign-in, being the same public ones Microsoft 365 and Azure clients use.

Endpoint	What it tells you
OpenID discovery login.microsoftonline.com/<domain>/v2.0/.well-known/openid-configuration	Tenant ID, in the issuer and endpoint URLs. A domain outside any tenant gets an error (AADSTS90002) instead.
Office federation provider odc.officeapps.live.com/odc/v2.1/federationprovider?domain=<domain>	Tenant ID, as tenantId. The field is left out when the domain isn't in a tenant, with HTTP 200 either way.
Access Control Service metadata accounts.accesscontrol.windows.net/<domain>/metadata/json/1	Tenant ID, as realm and in the issuer. Its allowedAudiences used to list every domain in the tenant. Microsoft stopped returning the full list in early 2026, rolling the change out gradually across its servers. The same metadata is served under other sign-in hosts too, such as login.microsoftonline.com, login.windows.net and sts.windows.net.
GetUserRealm login.microsoftonline.com/getuserrealm.srf?login=user@<domain>	Sign-in type, as NameSpaceType (Managed or Federated). Federation host, in AuthURL. Brand name, as FederationBrandName.
Azure Resource Manager subscription management.azure.com/subscriptions/<subscription-id>?api-version=2020-01-01	Tenant ID of a subscription, in the authorization_uri of the WWW-Authenticate header on the 401 response.
Microsoft Graph tenant information graph.microsoft.com/v1.0/tenantRelationships/findTenantInformationByDomainName(domainName='<domain>')	Tenant ID, display name, default domain and brand name, as tenantId, displayName, defaultDomainName and federationBrandName. Needs a token from any tenant with the CrossTenantInformation.ReadBasic.All permission.
Autodiscover GetFederationInformation autodiscover-s.outlook.com/autodiscover/autodiscover.svc	Every domain in the tenant, as the Domains list. Microsoft announced in MC1081538 that it would return only the domain asked about, and for a while it did. For a period in late 2026 requests returned the full list again, and now only some back-end servers return it.
DKIM selector record (DNS) selector1._domainkey.<domain> (CNAME)	The tenant's onmicrosoft name, in the record's target (selector1-<domain>._domainkey.<name>.onmicrosoft.com), when the domain signs its mail through Microsoft 365.
Tenant name check (DNS) <name>.onmicrosoft.com (MX)	Whether a tenant has that name. The domain has an MX record only when a tenant does.

Is the Azure tenant ID the same as the Microsoft 365 tenant ID?

Yes, for work and school accounts. Azure and Microsoft 365 sign an organization in through one Microsoft Entra ID tenant (formerly Azure AD), so the tenant has a single ID across them. The Azure portal calls it the Directory ID.

Can I list all domains in a tenant?

Yes. Open a tenant (or search for one of its domains) to see every domain seen in it, from checks of billions of domains and from the domain lists Microsoft publishes for each tenant, and whether each one is still there.

Why is a domain shown as moved or removed?

A later check found it in a different tenant, or in none.

What do Managed and Federated mean?

A managed domain signs users in with Microsoft directly. A federated domain sends them to another identity provider such as AD FS or Okta; the STS column shows its host.

Where does the data come from?

Tenant details come from some of the Microsoft endpoints in the table above. The domains checked come from web crawls and other domain lists, plus the domain lists Microsoft publishes for each tenant. No accounts or user data are involved.

References

Write-ups

Microsoft

MC1081538: Important update to the Get-FederationInformation cmdlet in Exchange Online

API

Look up tenants and domains with a simple JSON API. No key is needed.

GET/api/tenantsSearch tenants

Finds tenants by name, domain, tenant name or federation host, ranked as on the site. A tenant ID or an exact domain comes back first as a pinned result (match "tenant id" or "domain"), not counted in total.

Example response

{
  "query": "contoso",
  "page": 1,
  "size": 5,
  "total": 412,
  "total_capped": false,
  "results": [
    {
      "tenant_id": "6babcaad-604b-40ac-a9d7-9fd97c0b779f",
      "tenant_name": "Contoso, Ltd",
      "current_name": "Contoso, Ltd",
      "match": "domain",
      "domain_count": 6,
      "sample_domains": [
        "contoso.com",
        "contoso.onmicrosoft.com",
        "contoso.net"
      ],
      "active": true
    }
  ]
}

GET/api/tenants/{tenant_id}Get a tenant

A tenant's names and its domains, a page at a time. Dates appear only for something that changed.

Example response

{
  "tenant": "72f988bf-86f1-41af-91ab-2d7cd011db47",
  "active": true,
  "tenant_names": [
    {
      "name": "Microsoft",
      "active": true
    }
  ],
  "domain_count": 317,
  "active_domain_count": 313,
  "source": "build",
  "page": 1,
  "size": 3,
  "total": 317,
  "domains": [
    {
      "domain": "microsoft.com",
      "active": true,
      "status": "active"
    },
    {
      "domain": "azmosa.io",
      "active": false,
      "status": "former",
      "first_seen": "2025-08-04",
      "last_seen": "2026-10-29"
    }
  ]
}

GET/api/domains/{domain}Look up a domain

The tenant a domain is in now, how it signs in, and every tenant it has been in.

Example response

{
  "domain": "contoso.com",
  "tenant": "6babcaad-604b-40ac-a9d7-9fd97c0b779f",
  "status": "in_tenant",
  "source": "build",
  "sign_in": "Managed",
  "sts": null,
  "history": [
    {
      "tenant": "6babcaad-604b-40ac-a9d7-9fd97c0b779f",
      "active": true
    }
  ],
  "sign_in_history": []
}

GET/api/domainsLook up several domains

The same answer for up to 50 domains at once, in the order given.

Example response

{
  "results": [
    {
      "domain": "contoso.com",
      "tenant": "6babcaad-604b-40ac-a9d7-9fd97c0b779f",
      "name": "Contoso, Ltd",
      "status": "in_tenant",
      "sign_in": "Managed",
      "sts": null,
      "source": "build"
    },
    {
      "domain": "fabrikam.com",
      "tenant": "aef55cb1-b0a4-4d14-99f3-d35ed07d925b",
      "name": "Fabrikam Inc.",
      "status": "in_tenant",
      "sign_in": "Managed",
      "sts": null,
      "source": "build"
    }
  ]
}

Rate limit: 50 requests every 10 seconds per IP address. Past it, requests get 429 for 10 seconds.
Blocking: An IP address (or IPv6 /64) that makes over 3,000 requests in an hour, or gets over 300 errors for pages that don't exist, is blocked for a day, and for a week if it happens again. API answers never count as errors. Blocked requests get 403.
Live checks: A domain or tenant the data doesn't have yet is checked with Microsoft when asked for, and kept from then on. Each IP address (or IPv6 /64) gets 300 checks a day, and its network (IPv4 /24 or IPv6 /48) 3,000 in all. There is also a daily limit for everyone together. Past a limit, a miss comes back with "live": "skipped: daily limit". One request checks up to 25 misses, and the rest come back with "live": "skipped: too many in one request (ask again)".
Errors: {"detail": "…"} with 400 bad input, 404 not found, 422 out of range, 429 too many requests or 503 data still being built.