There a switch in Azure portal (accessed by Azure Active Directory / App registrations / View all applications / your app / Settings / Properties), with the label Multi-tenanted and options Yes or No. The tooltip on the label says:
Designates whether users in external organizations are allowed to grant your app access to data in their organization's directory. This control affects only the ability to grant access. It does not affect any access that has already been granted.
To me, it doesn't seem to imply that, for single-tenant app, no one except users in your AD can access your app. But, many other blog posts by individuals explicitly say that only those in your AD can access your app; for example, difference-between-single-vs-multi-tenant.
I could not find anything definitive about this in Microsoft documentation; for example in this doc.
Can someone clarify this for me and others who may have a doubt, by providing an authoritative source?