---
title: "Microsoft 365 tenant"
method: GET
path: "/check/tenant"
tags: ["check"]
---

# Microsoft 365 tenant

`GET /check/tenant`

The Azure AD / Microsoft 365 tenant a domain belongs to, from the cached
entity document (`azureTenant`) or a live OpenID-configuration lookup
when the domain has not been enriched yet. Domains only: an IP answers
400. A domain with no tenant answers 200 with `tenant: null` and a
`message`. Costs one request of the monthly quota.

## Query parameters

- `query` string

## Response `200`

`{"tenant": <raw tenant payload> | null, "message"?: string}` — the tenant object is the upstream shape (`tenantId`, `region`, `namespaceType`, … as fetched)

- TenantResponse
  - `message` string, nullable
  - `tenant` object, nullable

## Other responses

- `400` — Missing query, invalid domain, or an IP address
- `401` — Unauthorized - Missing or invalid API key
- `429` — Too many requests - Rate limit exceeded

## Changes

- **2026-09-23** `edb544398108` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/check/tenant/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/fe46a64acc79?raw)