Signing in to Canvas Forge is separate from connecting a Microsoft tenant. Tenant connections are granted per workspace with an explicit consent scope.