diff --git a/lib/galaxy/authnz/xsd/oidc_backends_config.xsd b/lib/galaxy/authnz/xsd/oidc_backends_config.xsd
index a8ffe7a0cd5..a8fbbd392d5 100644
--- a/lib/galaxy/authnz/xsd/oidc_backends_config.xsd
+++ b/lib/galaxy/authnz/xsd/oidc_backends_config.xsd
@@ -114,6 +114,13 @@
                                     </xs:documentation>
                                 </xs:annotation>
                             </xs:element>
+                            <xs:element name="tenant_id" minOccurs="0" type="xs:string">
+                                <xs:annotation>
+                                    <xs:documentation>
+                                        Tenant ID for the IdP.
+                                    </xs:documentation>
+                                </xs:annotation>
+                            </xs:element>
                             <xs:element name="pkce_support" minOccurs="0" type="xs:boolean">
                                 <xs:annotation>
                                     <xs:documentation>
diff --git a/lib/galaxy/config/sample/oidc_backends_config.xml.sample b/lib/galaxy/config/sample/oidc_backends_config.xml.sample
index 9cf5480a2c6..ce8e8e1d0b2 100644
--- a/lib/galaxy/config/sample/oidc_backends_config.xml.sample
+++ b/lib/galaxy/config/sample/oidc_backends_config.xml.sample
@@ -192,12 +192,13 @@ Please mind `http` and `https`.
         <client_id> ... </client_id>
         <client_secret> ... </client_secret>
         <redirect_uri>http://localhost:8080/authnz/azure/callback</redirect_uri>
-        <!-- Azure client_id, client_secret, and api_url can be obtained by folowing the instructions at
+        <!-- Azure client_id, client_secret, and tenant_id can be obtained by folowing the instructions at
         https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app
 
-        The api_url will typiclly be https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/authorize
+        The required API URL will be automatically constructed from the provided tenant_id. In previous Galaxy versions
+         the entire "api_url" had to be provided including the tenant ID, this is no longer a valid configuration option.
          -->
-        <api_url> ... </api_url>
+        <tenant_id> ... </tenant_id>
     </provider>
 
     <!-- Documentation: https://docs.egi.eu/providers/check-in/sp -->