...

All the described deployment scenarios can be combined. This allows you to find the best combination for your use cases. It’s also possible to migrate from one deployment scenario to another. But be aware that even though this is possible, it’s not an easy task to do. So be sure to select the ideal scenario for your use case.

Things to consider

Authentication

Each App Customer and each separate instance has its own Identity Provider and therefore its own user base. Especially when using the system as an IdP, this has major implications as usually a relying party only has one IdP associated. Let’s assume you have an customer relationship portal where both employee as well as customers should have access to. You could seperate the customers in one AppCustomer and the employees into another AppCustomer, giving you a clear seperation of the data. For the customer relationship portal you are now facing the challenge, that the portal only has one IdP. So you need to either choose the customer AppCustomer and configure a federation for the employees or combine both user groups in one AppCustomer.