Multi-tenant admin console: solo developer, in production within two months

I was working for a Quebec non-profit in education technology. Its SaaS platform uses AI to correct students' writing, for schools across Quebec. It therefore handles data about minor students, subject to Law 25, Quebec's privacy law.

The platform runs on several Azure production environments. Each one combines a web application, a database, a Python pipeline and an LLM, and its database is shared by about ten customers. At first, environments separated customers by identity provider, Microsoft Entra on one side and Google Workspace on the other. Then, as new customers signed on, new environments were added.

The internal team, from support to product, needed to manage the customers of every environment: create users, assign roles, organize groups, import entire lists at once.

Two constraints made it a demanding job:

• a single developer, me, to deliver everything: infrastructure, API, user interface and authentication;
• sensitive data: a mistake in access rights could expose information about students.

Infrastructure is code

The entire infrastructure is described with Pulumi on Azure. An environment is no longer a series of clicks in a portal: it is versioned code that can be replayed identically. That is what allowed me to provision four customer environments without doing the same work four times.

Authentication, handed over to the platform

Rather than building authentication in-house, I relied on Easy Auth, Azure's built-in authentication: users are authenticated by the platform before their request even reaches the API. Less authentication code to write also means less sensitive code to maintain.

An API and a UI built for daily work

• API: NestJS, with Prisma to access SQL Server data.
• User interface: React and TypeScript.

The features delivered cover the team's everyday work:

• user, role and group management;
• bulk import with an error report that pinpoints what to fix;
• multi-provider sign-in, with Microsoft and Google.

• In production within two months, from the first infrastructure resource to the last page of the UI.
• Four customer environments provisioned on Azure from the same code.
• A console used every day by the internal team to manage customers.

• When you work alone, automation becomes your team. Infrastructure as code remembers every environment, and an automated review of each pull request brings the second pair of eyes that is missing: more on that in the article on AI code review.
• Delegate what is not your core business. Authentication is a solved problem: better to rely on the platform than to solve it again.
• Compliance has to be designed in from the start. On a platform that handles student data, traceability cannot be bolted on later: see the audit log and the data lifecycle.