A system manages tenant application updates in a multi-tenant cloud-based identity and access management (IAM) system by defining one or more application templates; creating one or more applications for one or more tenants of the multi-tenant cloud-based IAM system using the one or more application templates; applying a change to at least one of the one or more application templates; determining whether the one or more applications need to be updated in an automatic mode, a semi-automatic mode, or a manual mode, to incorporate the change; and updating at least one of the one or more applications in an applicable one of the automatic mode, the semi-automatic mode, or the manual mode, based on the outcome of the determining.