diff --git a/src/main/java/org/opensearch/security/auditlog/impl/AbstractAuditLog.java b/src/main/java/org/opensearch/security/auditlog/impl/AbstractAuditLog.java
index 9c73707209..fe0bf8d4b4 100644
--- a/src/main/java/org/opensearch/security/auditlog/impl/AbstractAuditLog.java
+++ b/src/main/java/org/opensearch/security/auditlog/impl/AbstractAuditLog.java
@@ -229,6 +229,7 @@ public void logFailedLogin(String effectiveUser, boolean securityadmin, String i
         msg.addRestRequestInfo(request, auditConfigFilter);
         msg.addInitiatingUser(initiatingUser);
         msg.addEffectiveUser(effectiveUser);
+        msg.addTenant(getTenant(request));
         msg.addIsAdminDn(securityadmin);
         enrichWithUserContext(msg);
         save(msg);
@@ -247,6 +248,7 @@ public void logSucceededLogin(String effectiveUser, boolean securityadmin, Strin
         msg.addRestRequestInfo(request, auditConfigFilter);
         msg.addInitiatingUser(initiatingUser);
         msg.addEffectiveUser(effectiveUser);
+        msg.addTenant(getTenant(request));
         msg.addIsAdminDn(securityadmin);
         enrichWithUserContext(msg);
         save(msg);
@@ -263,6 +265,7 @@ public void logMissingPrivileges(String privilege, String effectiveUser, Securit
         msg.addRemoteAddress(remoteAddress);
         msg.addRestRequestInfo(request, auditConfigFilter);
         msg.addEffectiveUser(effectiveUser);
+        msg.addTenant(getTenant(request));
         msg.addPrivilege(privilege);
         enrichWithUserContext(msg);
         save(msg);
@@ -279,6 +282,7 @@ public void logGrantedPrivileges(String effectiveUser, SecurityRequest request)
         msg.addRestRequestInfo(request, auditConfigFilter);
         msg.addEffectiveUser(effectiveUser);
         enrichWithUserContext(msg);
+        msg.addTenant(getTenant(request));
         save(msg);
     }
 
@@ -299,6 +303,7 @@ public void logMissingPrivileges(String privilege, TransportRequest request, Tas
             getUser(),
             null,
             null,
+            getTenant(),
             remoteAddress,
             request,
             getThreadContextHeaders(),
@@ -338,6 +343,7 @@ public void logGrantedPrivileges(String privilege, TransportRequest request, Tas
             getUser(),
             null,
             null,
+            getTenant(),
             remoteAddress,
             request,
             getThreadContextHeaders(),
@@ -378,6 +384,7 @@ public void logIndexEvent(String privilege, TransportRequest request, Task task)
             getUser(),
             null,
             null,
+            getTenant(),
             remoteAddress,
             request,
             getThreadContextHeaders(),
@@ -603,6 +610,7 @@ public void logBadHeaders(TransportRequest request, String action, Task task) {
             getUser(),
             null,
             null,
+            getTenant(),
             remoteAddress,
             request,
             getThreadContextHeaders(),
@@ -635,6 +643,7 @@ public void logBadHeaders(SecurityRequest request) {
         msg.addRemoteAddress(remoteAddress);
         msg.addRestRequestInfo(request, auditConfigFilter);
         msg.addEffectiveUser(getUser());
+        msg.addTenant(getTenant(request));
 
         save(msg);
     }
@@ -655,6 +664,7 @@ public void logSecurityIndexAttempt(TransportRequest request, String action, Tas
             getUser(),
             false,
             null,
+            getTenant(),
             remoteAddress,
             request,
             getThreadContextHeaders(),
@@ -694,6 +704,7 @@ public void logSSLException(TransportRequest request, Throwable t, String action
             getUser(),
             false,
             null,
+            getTenant(),
             remoteAddress,
             request,
             getThreadContextHeaders(),
@@ -728,6 +739,7 @@ public void logSSLException(SecurityRequest request, Throwable t) {
         msg.addRestRequestInfo(request, auditConfigFilter);
         msg.addException(t);
         msg.addEffectiveUser(getUser());
+        msg.addTenant(getTenant(request));
         save(msg);
     }
 
@@ -759,6 +771,7 @@ public void logDocumentRead(String index, String id, ShardId shardId, Map<String
             TransportAddress remoteAddress = getRemoteAddress();
             msg.addRemoteAddress(remoteAddress);
             msg.addEffectiveUser(effectiveUser);
+            msg.addTenant(getTenant());
             msg.addIndices(new String[] { index });
             msg.addResolvedIndices(new String[] { index });
             msg.addShardId(shardId);
@@ -832,6 +845,7 @@ public void logDocumentWritten(ShardId shardId, GetResult originalResult, Index
         TransportAddress remoteAddress = getRemoteAddress();
         msg.addRemoteAddress(remoteAddress);
         msg.addEffectiveUser(effectiveUser);
+        msg.addTenant(getTenant());
         msg.addIndices(new String[] { shardId.getIndexName() });
         msg.addResolvedIndices(new String[] { shardId.getIndexName() });
         msg.addId(id);
@@ -981,6 +995,7 @@ public void logDocumentDeleted(ShardId shardId, Delete delete, DeleteResult resu
         TransportAddress remoteAddress = getRemoteAddress();
         msg.addRemoteAddress(remoteAddress);
         msg.addEffectiveUser(effectiveUser);
+        msg.addTenant(getTenant());
         msg.addIndices(new String[] { shardId.getIndexName() });
         msg.addResolvedIndices(new String[] { shardId.getIndexName() });
         msg.addId(id);
@@ -1076,6 +1091,7 @@ public void logDocumentDeleted(ShardId shardId, Delete delete, DeleteResult resu
     public void logApiTokenCreated(String tokenName, String createdBy) {
         AuditMessage msg = new AuditMessage(AuditCategory.API_TOKEN_WRITE, clusterService, getOrigin(), null);
         msg.addEffectiveUser(createdBy);
+        msg.addTenant(getTenant());
         msg.addSecurityConfigWriteDiffSource("{\"action\":\"created\",\"token_name\":\"" + tokenName + "\"}", tokenName);
         save(msg);
     }
@@ -1084,6 +1100,7 @@ public void logApiTokenCreated(String tokenName, String createdBy) {
     public void logApiTokenRevoked(String tokenId, String revokedBy) {
         AuditMessage msg = new AuditMessage(AuditCategory.API_TOKEN_WRITE, clusterService, getOrigin(), null);
         msg.addEffectiveUser(revokedBy);
+        msg.addTenant(getTenant());
         msg.addSecurityConfigWriteDiffSource("{\"action\":\"revoked\",\"token_id\":\"" + tokenId + "\"}", tokenId);
         save(msg);
     }
@@ -1266,6 +1283,27 @@ private String getUser() {
         return user == null ? null : user.getName();
     }
 
+    private String getTenant() {
+        User user = threadPool.getThreadContext().getTransient(ConfigConstants.OPENDISTRO_SECURITY_USER);
+        if (user == null && threadPool.getThreadContext().getHeader(ConfigConstants.OPENDISTRO_SECURITY_USER_HEADER) != null) {
+            user = this.userFactory.fromSerializedBase64(
+                threadPool.getThreadContext().getHeader(ConfigConstants.OPENDISTRO_SECURITY_USER_HEADER)
+            );
+        }
+        return user == null ? null : user.getRequestedTenant();
+    }
+
+    private String getTenant(SecurityRequest request) {
+        final String fromUser = getTenant();
+        if (fromUser != null) {
+            return fromUser;
+        }
+        if (request == null) {
+            return null;
+        }
+        return request.header("securitytenant");
+    }
+
     /**
      * Enriches the audit message with user roles and authentication method.
      * Resolves the User from ThreadContext — suitable for single-message REST paths.
diff --git a/src/main/java/org/opensearch/security/auditlog/impl/AuditMessage.java b/src/main/java/org/opensearch/security/auditlog/impl/AuditMessage.java
index f9c89a5eb0..a52b0d15ed 100644
--- a/src/main/java/org/opensearch/security/auditlog/impl/AuditMessage.java
+++ b/src/main/java/org/opensearch/security/auditlog/impl/AuditMessage.java
@@ -92,6 +92,7 @@ public final class AuditMessage {
     public static final String CATEGORY = "audit_category";
     public static final String REQUEST_EFFECTIVE_USER = "audit_request_effective_user";
     public static final String REQUEST_INITIATING_USER = "audit_request_initiating_user";
+    public static final String REQUEST_TENANT = "audit_request_tenant";
     public static final String UTC_TIMESTAMP = "@timestamp";
 
     public static final String CLUSTER_NAME = "audit_cluster_name";
@@ -226,6 +227,12 @@ public void addEffectiveUser(String user) {
         }
     }
 
+    public void addTenant(String tenant) {
+        if (tenant != null && !tenant.isEmpty()) {
+            auditInfo.put(REQUEST_TENANT, tenant);
+        }
+    }
+
     public void addPath(String path) {
         if (path != null) {
             auditInfo.put(REST_REQUEST_PATH, path);
diff --git a/src/main/java/org/opensearch/security/auditlog/impl/RequestResolver.java b/src/main/java/org/opensearch/security/auditlog/impl/RequestResolver.java
index ea4289150e..b3347bead5 100644
--- a/src/main/java/org/opensearch/security/auditlog/impl/RequestResolver.java
+++ b/src/main/java/org/opensearch/security/auditlog/impl/RequestResolver.java
@@ -71,6 +71,7 @@ public static List<AuditMessage> resolve(
         final String effectiveUser,
         final Boolean securityadmin,
         final String initiatingUser,
+        final String tenant,
         final TransportAddress remoteAddress,
         final TransportRequest request,
         final Map<String, String> headers,
@@ -97,6 +98,7 @@ public static List<AuditMessage> resolve(
                     effectiveUser,
                     securityadmin,
                     initiatingUser,
+                    tenant,
                     remoteAddress,
                     action,
                     privilege,
@@ -137,6 +139,7 @@ public static List<AuditMessage> resolve(
                 effectiveUser,
                 securityadmin,
                 initiatingUser,
+                tenant,
                 remoteAddress,
                 action,
                 privilege,
@@ -161,6 +164,7 @@ private static AuditMessage resolveInner(
         final String effectiveUser,
         final Boolean securityadmin,
         final String initiatingUser,
+        final String tenant,
         final TransportAddress remoteAddress,
         final String action,
         final String priv,
@@ -181,6 +185,7 @@ private static AuditMessage resolveInner(
         final AuditMessage msg = new AuditMessage(category, cs, origin, Origin.TRANSPORT);
         msg.addInitiatingUser(initiatingUser);
         msg.addEffectiveUser(effectiveUser);
+        msg.addTenant(tenant);
         msg.addRemoteAddress(remoteAddress);
         msg.addAction(action);
 
diff --git a/src/test/java/org/opensearch/security/auditlog/integration/BasicAuditlogTest.java b/src/test/java/org/opensearch/security/auditlog/integration/BasicAuditlogTest.java
index 96779fdb9a..fb68759b65 100644
--- a/src/test/java/org/opensearch/security/auditlog/integration/BasicAuditlogTest.java
+++ b/src/test/java/org/opensearch/security/auditlog/integration/BasicAuditlogTest.java
@@ -988,4 +988,51 @@ public void testSensitiveMethodRedaction() throws Exception {
         assertThat(TestAuditlogImpl.messages.size(), is(1));
         Assert.assertTrue(TestAuditlogImpl.sb.toString().contains(expectedUpdateUserRequestBody));
     }
+
+    @Test
+    public void testTenantFieldOnAuthenticatedRestRequest() throws Exception {
+        final Settings settings = Settings.builder()
+            .put("plugins.security.audit.type", TestAuditlogImpl.class.getName())
+            .put(ConfigConstants.OPENDISTRO_SECURITY_AUDIT_CONFIG_DISABLED_REST_CATEGORIES, "NONE")
+            .put(ConfigConstants.OPENDISTRO_SECURITY_AUDIT_CONFIG_DISABLED_TRANSPORT_CATEGORIES, "NONE")
+            .build();
+        setup(settings);
+
+        final List<AuditMessage> messages = TestAuditlogImpl.doThenWaitForMessages(() -> {
+            final HttpResponse response = rh.executeGetRequest(
+                "_search",
+                encodeBasicHeader("admin", "admin"),
+                new BasicHeader("securitytenant", "engineering_tenant")
+            );
+            assertThat(response.getStatusCode(), equalTo(HttpStatus.SC_OK));
+        }, 2);
+
+        messages.forEach(
+            message -> assertThat(message.toJson(), message.getAsMap().get(AuditMessage.REQUEST_TENANT), equalTo("engineering_tenant"))
+        );
+        validateMsgs(messages);
+    }
+
+    @Test
+    public void testTenantFieldOnFailedLogin() throws Exception {
+        final Settings settings = Settings.builder()
+            .put("plugins.security.audit.type", TestAuditlogImpl.class.getName())
+            .put(ConfigConstants.OPENDISTRO_SECURITY_AUDIT_CONFIG_DISABLED_REST_CATEGORIES, "NONE")
+            .build();
+        setup(settings);
+
+        final List<AuditMessage> messages = TestAuditlogImpl.doThenWaitForMessages(() -> {
+            final HttpResponse response = rh.executeGetRequest(
+                "_search",
+                encodeBasicHeader("admin", "wrongpassword"),
+                new BasicHeader("securitytenant", "engineering_tenant")
+            );
+            assertThat(response.getStatusCode(), equalTo(HttpStatus.SC_UNAUTHORIZED));
+        }, 1);
+
+        assertThat(messages.get(0).getCategory(), equalTo(AuditCategory.FAILED_LOGIN));
+        assertThat(messages.get(0).getAsMap().get(AuditMessage.REQUEST_TENANT), equalTo("engineering_tenant"));
+
+        validateMsgs(messages);
+    }
 }