A method for securely enrolling a machine in a multi-tenant environment, wherein the multi-tenant environment is a cloud based service that provides resources to different tenants at different network locations wherein data that is associated with each of the different tenants is protected from access by the other tenants and wherein each tenant specifies its authentication procedures that employ different authentication protocols, the method comprising: establishing, by the multi-tenant environment, a trust relationship with each tenant using the tenant's authentication protocols; receiving, at the multi-tenant environment, a request from a machine (1, 2, 3, 4) to access a resource of a tenant (1-N) in the multi-tenant environment, wherein the request includes a token; determining, by the multi-tenant environment, whether to authenticate the machine before providing access to the resource; wherein the authentication of the machine is delegated from the multi-tenant environment to the tenant; the authenticating by the tenant comprising: retrieving, by the tenant, the trust relationship established with the tenant; determining, by the tenant, whether the token is valid using the retrieved trust relationship; when the token is valid, obtaining a certification authority certificate that corresponds to a subscription of the machine; deciding whether the certificate is valid and, if so, authenticating the machine; determining whether the machine is authenticated by the tenant; and authorizing access to the resource when the machine is determined to be authenticated by the tenant; wherein authentication of the machine is performed by the tenant by using an on-premise authentication mechanism of the tenant; and wherein at least two of the tenants of the multi-tenant environment use different authentication rules and protocols. establishing, by the multi-tenant environment, a trust relationship with each tenant using the tenant's authentication protocols; receiving, at the multi-tenant environment, a request from a machine (1, 2, 3, 4) to access a resource of a tenant (1-N) in the multi-tenant environment, wherein the request includes a token; determining, by the multi-tenant environment, whether to authenticate the machine before providing access to the resource; wherein the authentication of the machine is delegated from the multi-tenant environment to the tenant; the authenticating by the tenant comprising: retrieving, by the tenant, the trust relationship established with the tenant; determining, by the tenant, whether the token is valid using the retrieved trust relationship; when the token is valid, obtaining a certification authority certificate that corresponds to a subscription of the machine; deciding whether the certificate is valid and, if so, authenticating the machine; retrieving, by the tenant, the trust relationship established with the tenant; determining, by the tenant, whether the token is valid using the retrieved trust relationship; when the token is valid, obtaining a certification authority certificate that corresponds to a subscription of the machine; deciding whether the certificate is valid and, if so, authenticating the machine; determining whether the machine is authenticated by the tenant; and authorizing access to the resource when the machine is determined to be authenticated by the tenant; wherein authentication of the machine is performed by the tenant by using an on-premise authentication mechanism of the tenant; and wherein at least two of the tenants of the multi-tenant environment use different authentication rules and protocols.