A method for providing security in a multitenant application server environment comprising a plurality of partitions, a plurality of partition resources and a plurality of global resources, the method comprising: defining a plurality of security realms (702, 750, 760) including an admin security realm, a first security realm, and a second security realm, each security realm being a named configuration for security services; configuring a first partition of the plurality of partitions to have a first plurality of partition resources of the plurality of partition resources, the first partition being a first runtime and administrative subdivision of a domain and being associated with a first partition identifier and configuration; configuring a second partition of the plurality of partitions to have a second plurality of partition resources of the plurality of partition resources, the second partition being a second runtime and administrative subdivision of the domain and being associated with a second partition identifier and configuration; providing a first partition security configuration associating the first partition with the first security realm, wherein the first partition security configuration includes a first realm attribute that references the first security realm; providing a second partition security configuration associating the second partition with the second security realm, wherein the second partition security configuration includes a second realm attribute that references the second security realm; associating a first primary identity domain with the first partition, wherein the first primary identity domain represents a first plurality of users associated with a first tenant; associating a second primary identity domain with the second partition wherein the second primary identity domain represents a second plurality of users associated with a second tenant; operating each of said admin security realm, first security realm, and second security realm simultaneously at runtime to control authentication and authorization for access to said plurality of partition resources and said plurality of global resources; whereby the first plurality of users associated with the first tenant have access to the first plurality of partition resources of the first partition but not the second plurality of partition resources of the second partition; and whereby the second plurality of users associated with the second tenant have access to the second plurality of partition resources of the second partition but not the first plurality of partition resources of the first partition. defining a plurality of security realms (702, 750, 760) including an admin security realm, a first security realm, and a second security realm, each security realm being a named configuration for security services; configuring a first partition of the plurality of partitions to have a first plurality of partition resources of the plurality of partition resources, the first partition being a first runtime and administrative subdivision of a domain and being associated with a first partition identifier and configuration; configuring a second partition of the plurality of partitions to have a second plurality of partition resources of the plurality of partition resources, the second partition being a second runtime and administrative subdivision of the domain and being associated with a second partition identifier and configuration; providing a first partition security configuration associating the first partition with the first security realm, wherein the first partition security configuration includes a first realm attribute that references the first security realm; providing a second partition security configuration associating the second partition with the second security realm, wherein the second partition security configuration includes a second realm attribute that references the second security realm; associating a first primary identity domain with the first partition, wherein the first primary identity domain represents a first plurality of users associated with a first tenant; associating a second primary identity domain with the second partition wherein the second primary identity domain represents a second plurality of users associated with a second tenant; operating each of said admin security realm, first security realm, and second security realm simultaneously at runtime to control authentication and authorization for access to said plurality of partition resources and said plurality of global resources; whereby the first plurality of users associated with the first tenant have access to the first plurality of partition resources of the first partition but not the second plurality of partition resources of the second partition; and whereby the second plurality of users associated with the second tenant have access to the second plurality of partition resources of the second partition but not the first plurality of partition resources of the first partition.