Review all tools that authenticate with per-request TokenCredentials pass tenant ID when it is passed to ensure they're creating credentials for the tenant they'll be requesting against. If this isn't don't the request could fail due to the credential being used not having access to the tenant the request is made against.
Should also think about hiding the API which doesn't take tenant ID to enforce this.
Review all tools that authenticate with per-request
TokenCredentials pass tenant ID when it is passed to ensure they're creating credentials for the tenant they'll be requesting against. If this isn't don't the request could fail due to the credential being used not having access to the tenant the request is made against.Should also think about hiding the API which doesn't take tenant ID to enforce this.