EF Core global query filters help keep ordinary tenant-scoped queries on track, but they are application-level defaults—not an unbypassable security boundary. To prevent a reporting query from returning another tenant’s rows even when application code gets the predicate wrong, enforce tenant isolation in the database as well, and verify that the application’s actual database identity and session setup cause that policy to run.
What protects a tenant’s rows—and what does not?
In a shared database, tenant records commonly live in the same tables and carry a tenant discriminator such as TenantId. A reporting query must restrict its results to the authenticated user’s tenant. There are two distinct places to apply that restriction:
As an Amazon Associate I earn from qualifying purchases.
- Application-level filtering: EF Core can add a tenant predicate automatically to entity queries through a global query filter. This is a useful default, but code can disable the filter, and data access outside that filtered query path does not automatically receive it.
- Database-enforced row-level security (RLS): SQL Server can apply a security policy with a predicate function that filters rows in the database. When the policy is correctly configured for the application’s database identity and session, the database—not merely a convention in application code—enforces the predicate.
Therefore, an EF Core filter alone cannot support the claim that users cannot bypass tenant isolation. Database RLS can provide that stronger boundary, but only if every relevant access path uses a database connection and identity for which the policy is active and correctly receives the tenant context.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchUse EF Core global query filters as a default guardrail
For a shared-table design, EF Core’s documented pattern is to make the tenant ID available to the DbContext and use it in the entity filter:
#1 Best Overall
public class MultitenancyContext(string tenantId) : DbContext
{
protected override void OnModelCreating(ModelBuilder modelBuilder)
{
modelBuilder.Entity<Blog>().HasQueryFilter(b => b.TenantId == tenantId);
}
}The tenant value must be resolved from trusted request identity and passed through the context’s construction and lifetime path. Do not accept a tenant ID from an untrusted report parameter as proof of authorization. Authentication and tenant resolution identify the tenant for the request; they do not, by themselves, make the database isolate rows.
Microsoft documents that global query filters can be disabled selectively. Treat them as a reliable default for ordinary EF entity queries, not as protection for code that disables filters or uses a data-access route that does not apply them. See EF Core global query filters.
Rank #2
Filter composition also depends on EF Core version. Before EF Core 10, multiple filters must be combined in one expression with &&. The documentation labels named filters as an EF Core 10 preview feature; confirm the version and feature status for the project before relying on named-filter behavior.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Make SQL Server RLS enforce the predicate in the database
SQL Server RLS uses a predicate function attached to a security policy to filter rows. A predicate can read a tenant value from SQL SESSION_CONTEXT. This moves enforcement to the database layer, where the policy applies to queries governed by it rather than relying on each report author to remember a tenant condition.
The tenant value still has to reach the database session through a trusted, correctly managed connection path. Microsoft’s Data API Builder documentation demonstrates setting claim values in SQL session context before executing a query. That is an example of a Data API Builder integration pattern; it is not built-in ASP.NET Core behavior or a complete ASP.NET Core setup recipe. See Microsoft’s session-context RLS guidance and its Data API Builder RLS quickstart.
For an ASP.NET Core application, design and test the mapping from authenticated identity to the database session value for the actual connection and pooling lifecycle. The cited documentation does not establish a universal ASP.NET Core implementation recipe. A policy that exists in the database but receives a missing, stale, or incorrectly assigned tenant value is not sufficient assurance.
Rank #4
- HP ProLiant DL360 G7 8B Server
- 2x X5650 2.66GHz 12-Cores Total
- 32GB RAM / 8x 146GB 10K 2.5in SAS Hard Drives
- P410 w/ 512MB
Choose a tenant data layout that fits the reporting system
| Layout | Isolation approach | EF Core support and reporting implications |
|---|---|---|
| Shared tables with a tenant discriminator | Rows share tables and include a tenant value. EF Core global filters can provide default scoping; database RLS can add enforcement when query mistakes must not expose another tenant’s rows. | EF Core documents global filters for discriminator-column tenancy. This keeps a shared reporting schema, but requires careful coverage of all data-access paths. |
| Database per tenant | Each tenant’s data resides in a separate database, selected through the appropriate connection configuration. | EF Core documents this as a supported approach. Provisioning, migrations, connection management, and cross-tenant reporting are architectural considerations; the cited guidance does not quantify their operational cost. |
| Schema per tenant | Tenants are separated by database schema. | EF Core documentation says this layout is not directly supported and does not recommend it as the EF Core solution. |
These layouts represent different isolation and operational choices; a tenant discriminator and an RLS policy are not the same thing as placing each tenant in a separate database. Microsoft’s EF Core multi-tenancy guidance describes the supported layouts and their EF Core implications.
Audit every reporting path, not just LINQ queries
A report can reach data through more than an ordinary EF entity query. Review each route that can read tenant data, and verify whether it is governed by the intended application filter, database policy, or both:
- EF Core LINQ queries, including any code that disables query filters.
- Raw SQL and stored procedures.
- Exports and scheduled report generation.
- Background jobs that run outside a user request.
- Cached report results and the tenant identity used to key or retrieve them.
- Administrative, analytics, or reporting database identities that may have different permissions or policy behavior.
These are engineering checks for the application’s actual access paths; the Microsoft sources cited here establish the distinction between EF filters and database policy, not a complete threat model for every reporting system. Verify behavior with the identities, session setup, and query routes used in production.
Keep authentication separate from row isolation
ASP.NET Core authentication determines who the application considers authenticated; it does not automatically choose and enforce a tenant boundary in the database. Microsoft’s ASP.NET Core 10.0 authentication overview states that ASP.NET Core does not include a built-in multi-tenant authentication solution. Tenant resolution and row isolation therefore need to be designed as explicit parts of the application and data-access architecture. See ASP.NET Core authentication overview.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
