Microsoft 365 Tenant Finder

Check hundreds or thousands of company domains for a Microsoft 365 / Entra ID tenant in one run. For each domain you get the tenant ID, tenant region, whether sign-in is managed (cloud) or federated, the federated identity provider (Okta, AD FS, Ping, OneLogin, Duo and more), the organization name shown at sign-in, the mail provider or email security gateway from MX, and Microsoft 365, Intune, Teams and Google Workspace DNS signals.

Everything comes from public, unauthenticated sources: Microsoft's OpenID discovery and home-realm endpoints plus public DNS. No logins, no API keys, and no mailbox probing.

Who it's for

• MSPs and Microsoft partners qualifying prospects: who's on Microsoft 365, who's still on Google Workspace or self-hosted mail, who already runs Intune, who uses Okta or AD FS
• Sales and lead-gen teams enriching account lists with a reliable "uses Microsoft 365" flag and their email security vendor (Proofpoint, Mimecast, Barracuda...)
• IT admins documenting tenants for a domain portfolio, mergers and acquisitions, or B2B collaboration setup (tenant IDs for cross-tenant access settings)

Input

• domains: company domains. URLs and email addresses are cleaned to the bare domain and duplicates removed (up to 10,000).
• concurrency (optional): domains processed in parallel, default 8, max 25.

{ "domains": ["microsoft.com", "okta.com", "jane@example.org"] }

Output

One dataset row per domain, for example:

{
  "domain": "okta.com",
  "hasM365Tenant": true,
  "tenantId": "f1f9fcc4-c616-4261-8a82-855dc9cb8486",
  "tenantRegion": "NA",
  "tenantSubRegion": null,
  "cloudInstance": "microsoftonline.com",
  "signInType": "Federated",
  "identityProvider": "Okta",
  "federationAuthHost": "okta.okta.com",
  "organizationName": "Okta, Inc.",
  "initialOnMicrosoftDomain": null,
  "mailProviders": ["Proofpoint"],
  "mx": ["mx0a-00012345.pphosted.com"],
  "spfIncludes": ["..."],
  "dmarcPolicy": "reject",
  "signals": {
    "exchangeOnlineMx": false,
    "exchangeOnlineSpf": false,
    "msDomainVerificationTxt": false,
    "autodiscoverToOutlook": false,
    "intuneEnrollmentCname": false,
    "teamsSkypeRecords": true,
    "m365DkimCname": false,
    "googleWorkspaceMx": false,
    "googleSiteVerificationTxt": true
  },
  "summary": "Microsoft 365 tenant (Federated via Okta); mail: Proofpoint",
  "errors": []
}

Field notes

• tenantRegion is Microsoft's region scope (NA, EU, WW, AS, OC, SA, AF). tenantSubRegion shows GCC for US Government Community Cloud tenants.
• signInType is Managed (passwords or passwordless handled by Entra ID) or Federated (sign-in is redirected to another identity provider).
• initialOnMicrosoftDomain is filled when the domain publishes Microsoft 365 DKIM CNAMEs that reveal the tenant's *.onmicrosoft.com name.
• A tenant can exist without mail in Microsoft 365 (for example Azure-only or a Google Workspace shop with an Entra tenant). Use mailProviders and signals to tell them apart.
• Lookups that hit an error are listed under errors instead of being reported as "no tenant".

Pricing

Pay per event: $3 per 1,000 domains checked ($0.003 each). Domains whose Microsoft lookup errors out aren't charged.

Related

• Bulk SPF / DMARC / MX Auditor scores email-spoofing risk for the same domain lists.
• Free browser tools for admins: SysAdmin Toolbox.