It's made per component. An application may use a multi-tenanted architecture for the authorization component, while storing sensitive data in an isolated data store for each tenant.

A control plane provides control at admin level in parallel with the multi-tenant applications (Fig. 2). Another function of the control plane is the onboarding of tenants.