Some documentation and videos regarding Device Provisioning Service (DPS) says it can handle multitenancy but, it seem there is a confusion about how one tenant's configuration/data is isolated from other tenants. lets say I have 5 tenants and each of them having 1000 devices which I need to onboard to IoT hub of their respective tenant (assume I have one IoT hub per tenant). Enrollment group is a perfect thing to do in this situation but then do I have to create 5 enrollment list (one per tenant) and configure all the devices and their attestation mechanism in the list? if this is the right way then is the "attestation mechnism" makes difference in isolation of registering tenant's devices?
Some of the document also says tenant isolation is based on the ID scope of DPS, which means I need to create 5 DPS instances (one per tenant) and give this ID scope and registration URL in the registration software during manufacturing process? If that is the case wouldn't this be a mess to handle it at manufacturing step to encode ID scope for each tenant's device?