A computer-implemented method comprising: receiving a user token from a client device that is registered with a first tenant of a service application of a server, the user token being provided to the client device by a directory service application after validating the client device ; receiving a request, from the client device , to access a second feature of a second tenant of the service application, the second feature of the second tenant of the service application being separate from a first feature of the first tenant of the service application, the second feature being only accessible to devices registered with the second tenant of the service application; authenticating the request by validating the user token from the client device ; in response to validating the user token, determining a cross-tenant policy of the second tenant of the service application based on the user token, by accessing a cross-tenant permission map; and identifying, from the cross-tenant permission map, a cross-tenant API metadata associated with the second tenant, the cross-tenant API metadata indicating a cross-tenant access permission right for the second tenant; and forming, at the server, an identity object based on the cross-tenant policy, the identity object comprising a permission value of a permission attribute that identifies a level of access to the second feature of the second tenant of the service application to the client device ; wherein the identity object identifies: a user identifier associated with the user token, the first tenant that indicates a home tenant of a user associated with the user identifier, the second tenant that indicates a resource tenant for the user associated with the user identifier, the service application, and permission access rights to the service application of the second tenant. receiving a user token from a client device that is registered with a first tenant of a service application of a server, the user token being provided to the client device by a directory service application after validating the client device ; receiving a request, from the client device , to access a second feature of a second tenant of the service application, the second feature of the second tenant of the service application being separate from a first feature of the first tenant of the service application, the second feature being only accessible to devices registered with the second tenant of the service application; authenticating the request by validating the user token from the client device ; in response to validating the user token, determining a cross-tenant policy of the second tenant of the service application based on the user token, by accessing a cross-tenant permission map; and identifying, from the cross-tenant permission map, a cross-tenant API metadata associated with the second tenant, the cross-tenant API metadata indicating a cross-tenant access permission right for the second tenant; and accessing a cross-tenant permission map; and identifying, from the cross-tenant permission map, a cross-tenant API metadata associated with the second tenant, the cross-tenant API metadata indicating a cross-tenant access permission right for the second tenant; and forming, at the server, an identity object based on the cross-tenant policy, the identity object comprising a permission value of a permission attribute that identifies a level of access to the second feature of the second tenant of the service application to the client device ; wherein the identity object identifies: a user identifier associated with the user token, the first tenant that indicates a home tenant of a user associated with the user identifier, the second tenant that indicates a resource tenant for the user associated with the user identifier, the service application, and permission access rights to the service application of the second tenant. <EOS>