UserManager, RoleManager and SignInManager. Each tenant can create roles and grant those roles various permissions. Simplified table setup looks like this:SignInManager.SignInAsync , so it only adds the roles a given user has for whichever tenant is signed into