I don’t usually set out to build products. This is the background story of how I accidentally ended up building something that turned out to be useful to others: sub2tenant.com
The problem I kept running into
At Bsure, we deliver an Azure Managed Application. In Microsoft Partner Center there are a lot of reports to download, and keeping track of them has often been my responsibility.
Each customer runs our product in their own Azure subscription. When looking at reports, it’s not always obvious which customer a given subscription ID belongs to. This becomes even more confusing when the subscription was purchased through a CSP, where the CSP display name may be shown instead of the end customer.
Long story short: before we had proper automation in place, I frequently found myself needing to answer one simple question:
Which end customer does this subscription ID actually belong to
Manual lookup method
There’s a trick that has been known for quite some time: you can retrieve the tenantId by inspecting the WWW-Authenticate response header.
I used a PowerShell function shared by Lieben to manually extract the tenantId. Once I had that, there were several online tools available to look up tenant details.
In practice, I often ended up using the AADInternals OSINT tool to map the tenant ID to a tenant name. It worked , but the process was very manual and repetitive.
Started as an internal tool
I’ve never really considered myself a developer, but I have a decent understanding of how things are wired together. At Bsure we work a lot with Azure Container Apps and Microsoft Graph, so I thought: why not try to stitch something together myself?
With quite a bit of help from my favourite LLM, it quickly took shape into something useful.
A simple Next.js app running on an Azure container apps
- The
subscriptionId→tenantIdlookup using theWWW-Authenticateheader requires no authentication. - To look up tenant information from a
tenantId, I assigned the system-managed identity of the Azure Container App theCrossTenantInformation.ReadBasic.AllMicrosoft Graph permission. This allowed me to callfindTenantInformationByTenantIdand retrieve basic tenant information. - Since this was an internal tool, I put it behind Entra ID authentication.
That was more or less it. A few hours of experimentation, and it was up and running.
“This might actually be useful to others”
I kept coming back to the thought that this might be useful beyond our internal use. So about a month ago, I decided to give it a go one weekend. If nothing else, it would be a fun learning project:
- bought sub2tenant.com
- deployed it in my separate personal tenant
- polished and stripped UI down to the absolute minimum
To get some early feedback, I shared it on two subreddits: r/Azure and r/msp.
The feedback was immediately positive, but there was some pushback around the code not being public, and the resulting trust concerns were completely valid.
Luckily, I already had everything wired up with GitHub and GitHub Actions. I cleaned up the repository, added an MIT license, and made it public:
👉 https://github.com/olhel/sub2tenant-aca
Fully open source.
3-in-1 tool & SEO/AEO
Looking up tenant information only from a subscription ID is fairly niche. So I expanded the tool to support multiple lookup methods from the same input field:
- Subscription ID → Tenant information
- Tenant ID → Tenant information
- Domain name → Tenant information
This significantly widened the use case. I then spent a few evenings experimenting with search engine optimisation and AI-oriented optimisation.
I learned a lot in the process, and I was honestly surprised by how quickly the site started appearing in search results and being mentioned as an alternative by LLMs 👀
I might write a follow-up post focusing on that part later.
How it works
If you want to try it out, the tool lives at:
👉 https://sub2tenant.com
You can read more on the About and How it works pages. If you prefer to host your own version, the full source code is available in the sub2tenant-aca repository.