How are tenants and application publishers isolated?

Short answer

Tenant and publisher isolation prevents one organization’s credentials, users or audit data from being retrieved by another. Integrations should authenticate as a specific application publisher and honor tenant scope on every API call. Public SDK patterns imply partner-specific credentials; detailed multi-tenant controls belong in enterprise administration documentation.