Our business is currently looking to expand on providing solutions to customers. For example, there are multiple business units that might look to sell a service like power monitoring or energy utilization that is fed from IOT devices or energy resource son the customer site. The goal is to leverage Azure. We would plan on separating these environments into subscriptions with a shared service hub. The question is, would it be better to separate our customer environments from our internal Microsoft tenant?

Technical isolation can be achieved either by using a separate Azure AD tenant or by leveraging multiple subscriptions within a single tenant. The choice largely depends on how you plan to govern these environments.

Using a single tenant offers cost benefits, as commitments for compute, storage, and AI/ML services can be aggregated across subscriptions, optimizing resource utilization and reducing costs including service monitoring.

On the other hand, separating environments into multiple tenants provides advantages in regulatory compliance, allowing organizations to define in-scope or excluded tenants based on specific compliance or business requirements.

In this scenario, I would recommend separating internal and customer environments into different tenants. 

A dedicated Azure AD tenant enhances security by preventing accidental cross-access and privilege escalation between internal users and customer data. Additionally, many industries require strict data sovereignty and compliance isolation (e.g., GDPR, HIPAA), which is more effectively managed with a separate tenant.

Note: If you choose to separate tenants, you’ll need a cross-tenant identity model to enable shared service access, such as Azure B2B or Entra ID.

Yes, I think it is better for you to separate your customer environments from your internal Microsoft tenant. Not only it is easier to manage, you also need to ensure that your customer workloads and data are isolated from internal corporate IT resources to reduce security risks and minimizing cross-tenant dependencies.

Moreover, customers may want some ownership over their data and workloads, an isolated tenant provides clearer boundaries.