Azure AD Cross Tenant Synchronisation FIRST LOOK!

This week I’m delighted to have Arvind Harinder, Snr Product Manager in the Azure Active Directory Team in Redmond as my special guest. Arvind shares an exclusive first look at Azure AD cross-tenant synchronisation. This awesome and powerful new feature allows you to sync users from multiple tenants for what seems to be the ultimate in cross tenant collaboration. If you’re an IT Pro you’ll not want to miss this.
More details here learn.microsoft.com/en-us/azu...
Visit me at Andymalone.org

[@JustSaying290]

I have just passed my ms-500 the other day. Your channel helped a lot. Though it was tough cause not all our clients has the subscriptions or features. Your videos got me thru. Thanks Andy

[@AndyMaloneMVP]

Oh, that’s awesome Michael, congratulations and well done. It was my pleasure to help.

[@soodshubham7671]

Thank You Andy :)

[@mohammadhaque6404]

Thank you Andy!! Very useful for Migration!!

[@keithlucier8734]

Great video. TY

[@jamieelynne4]

You rock Andy!!

[@liveyrdream]

Thanks for the demo, very informative.

[@AndyMaloneMVP]

Very welcome😊

[@scottt2481]

Good questions Andy! thank you for making this available

[@AndyMaloneMVP]

You’re welcome and thank you, Scott

[@scottt2481]

@@AndyMaloneMVP Hi Andy, there appears to be some forced adoption of MFA and number matching. If you are able to slot this into a video, I would find that helpful. Potentially pairing with the Jan 2024 legacy MFA and SSPR policies being deprecated.

[@AndyMaloneMVP]

@@scottt2481 absolutely 👍

[@KefashWhite]

This is an amazing interview Andy. Arvind’s audio was a little muffled but great content.

[@AndyMaloneMVP]

Yeah, Teams audio (sorry)😊

[@michaelwhyte3995]

Great Video Andy. Def interested to know about the Teams experience. If the new "member" in Company B is accessing Teams channel in Company A hopefully they will not have to switch tenants in Teams as guests currently experience now.

[@AndyMaloneMVP]

I guess we will find out soon as this feature is currently being rolled out👍😊

[@humancarpet]

Really useful video and great questions posed to Arvind. This seems great. I've deployed as a test and setup and it seems to give great features - such as cross tenant address book etc.. Does seem to have broken our ability to add people from either tenant into shared channels though for native teams usage. Any experience of this?

[@AndyMaloneMVP]

Thanks Edward as this is in preview, I'm sure this will be addressed in a final release :-)

[@OmerMFC]

Would've been great to see this then be implemented within SharePoint visually, great vid Andy!

[@AndyMaloneMVP]

Thank you 👍

[@b_wheel]

This looks great, the only thing that I think it's missing for an M&A (maybe there is another way to do it) is a way to allow all users to have an email address in the same single domain as an alias or even better as the primary.

[@AndyMaloneMVP]

Let’s see what happens when it goes general availability. Thanks again.

[@zachariahthesonofzachariah9506]

Thanks Andy. I have setup a cross tenant sync and watching your video helped with the setup. The users in both tenant still have to switch organisation to access channels and chat. Am I missing anything here ? Or Is it expected please ?

[@AndyMaloneMVP]

Here a couple of useful articles that will definitely help you learn.microsoft.com/en-us/azure/active-directory/multi-tenant-organizations/cross-tenant-synchronization-overview and learn.microsoft.com/en-us/microsoftteams/shared-channels

[@YeahButNah100]

Hey Andy, loving the series, been very helpful thank you. I was just wondering if you have any pointers for getting Azure AD free to work. it keeps claiming i am not eligible even though i have never owned it before. need it for retraining myself for new job opportunities. quite distressed i cant gain access. set up a server at home and everything just so i could follow along. any ideas are appreciated, cheers.

[@AndyMaloneMVP]

Hey thanks for the question. AAD free is very limited and will not be able to connect to an on prem server. To practice I would just use trial accounts E5 as these contain all the features. Not sure about the eligible message. Try the MS tech community pages for that. Delighted that you’re enjoying my content though 👍😊

[@elhamkarshenas3163]

Hi Andy, not sure if this question was raised before - are you aware if external users are already setup in tenant via B2B collaboration, what happens if tenant synchronisation enables with their home tenant? Would it connect to the same external identity (I assume), or would it create another identity? Hopefully it connects to the same B2B identity to preserve all existing permissions and settings!

[@AndyMaloneMVP]

It would detect a guest user already exists as it has a unique ID. It would not be overwritten.

[@danpowell7421]

Awesome Video Would this be something to use for a tenant-to-tenant migration? Or is it only for the cross-tenant collaboration that Synchronisation should really be used?

[@AndyMaloneMVP]

No this is not a migration tool. It’s a collaboration tool😊

[@sincho17]

@@AndyMaloneMVP ist there any useful tenant-to-tenant migration tool from microsoft or i should use 3rd party tools. If then which you will suggest?

[@H_Raja]

Great video, another question I had. I thought the target tenant would have the same UPN, but does not seem to be the case? Is that correct?

[@AndyMaloneMVP]

Correct it creates guest accounts

[@dingdonghello1131]

Great video. If I have a one way trust where tenant A permits users from tenant B as guests, which tenant requires the Azure AD Premium License?

[@AndyMaloneMVP]

Sorry I'm not a sales guy. It's only in preview

[@jeffli4198]

Thank for your sharing. BTW, not sure one single on-premises AD account can sync with two different 365 tenant ? Cheers

[@AndyMaloneMVP]

You can but it's only collaboration. Creates a dynamic guest account in the partner tenant and removes it afterwards.

[@jeffli4198]

@@AndyMaloneMVP Thanks !

[@aakashcinecreations8667]

Hi Andy, This feature is good and solves our problems, i have a question on this, All our users are synced to cloud through AAD connect but still their UserType is Guest(we use this tenant for o365 purpose) now we want users from this tenant need to sync to other tenant, is that possible? Asking this because users are still Guests in home tenant

[@AndyMaloneMVP]

This is correct. When ever you sync to another tenant, the user account will come in as a guest account. If one already exists it will simply update it and connect to it.. It is weird that your users in your home tenant are guests. Somethings not right with that. I would reach out for technical support on this, or visit the Microsoft Tech community. Either way, I wish you the best

[@soloapefe]

How would this work for Teams collabs. Today when you are a guest in a other organizations teams, you must change to the correct org in the top right corner. Whitthis cross tenant sync, will the team in the external org show up in your main Teams? Or do you still need to change to the external org to see the teams you are a guest in?

[@AndyMaloneMVP]

This is new so I'm not sure. But I suspect it would be like shared channels where you don't need to login out/in

[@kisankamble5611]

Great video, Thank you, Andy. enabling cross-tenent synchro, can we share address/contact in office 365/exchange online with partner company/tenant?

[@AndyMaloneMVP]

This is done via exchange org sharing

[@g6bpc]

what about the Exchange GAL. will that be an item that can sync? i understand the freebusy aspect is done via org sharing. just lookin or wondering if this would help with GALs being shared Thank you and great stuff

[@terry9301]

Hi Andy, I am very keen to know and would like to follow up with the latest update of this Cross Tenant Synchronisation function. May i know if there is any website/link that I can check for the latest update. Thanks!

[@AndyMaloneMVP]

This is the best place :-) learn.microsoft.com/en-us/azure/active-directory/multi-tenant-organizations/cross-tenant-synchronization-overview

[@robwellesley]

Hi Andy. with the 'other' users ending up in AAD as members, does this have implications for InTune config profiles where the 'all users' group is used?

[@AndyMaloneMVP]

In tune managers devices that are Azure AD joined. The users that use these devices must have an appropriate license. Only then does the device appear in in tune, which can then be managed

[@Adam77734]

What a great demo. Is it possible to add synced users to a group?

[@AndyMaloneMVP]

Of course, you can add them through dynamic groups. As long as the attributes match, for example, city, department, ECT, then it should work.

[@Adam77734]

@@AndyMaloneMVP Thank you!

[@ReNiCGaming]

Hi, what if some users already have been added to guests in the other tenant then we enable this?

[@AndyMaloneMVP]

The account will remain

[@IsaacAlves27]

Hi Andy. I would need to do something similar with a non Azure tenant what options do I have available in that case?

[@AndyMaloneMVP]

To be honest, I’ve not looked at this fully yet. I would read the docs.microsoft.com article as listed in the description. As this is currently in beta, there is a strong possibility that it’s not finished or at the very least we don’t not understand its full potential yet. But it is exciting!

[@benjones869]

Does this work between 21vianet and regular tenants? Noticed the checkbox to support 21vianet came out of preview too! This is great news if it does.

[@AndyMaloneMVP]

Yes I believe so👍

[@benjones869]

@@AndyMaloneMVP ah, I just found in the faq that it's not supported yet. 😭 Fingers crossed its in the works. Great video. Thank you.

[@OlivioMoura-ob3ff]

As today there is no delete Cross-tenant synchronization configuration option after you create one.

[@wheninrome42]

Would this allow file share access across tenant? ie: File Server is on Woodgrove, user is on ZT Tire and needs to access the Woodgrove file share Right now I have users accessing 4 different tenant file shares and its a mess of usernames/double authentication

[@AndyMaloneMVP]

I'd checkout learn.microsoft.com for the latest updates on this :-)

[@tyve]

How about licensing, is the synced user licens valid in both tenants?

[@AndyMaloneMVP]

No idea yet sorry.

[@thomasniemann]

Before i get my hopes up, compatible with Gcc High tenants?

[@AndyMaloneMVP]

You would need to check in your region sorry😊

[@entrasynchronization]

Intra-cloud sync will be rolled out to GCC High in the next month or so. Cross-cloud sync will come after this initial feature set gets to GA.

[@H_Raja]

What are the license implications? Does it take the licence from home tenant or will it consume another licence in the cross tenant?

[@AndyMaloneMVP]

This is currently in preview so you’ll need to the read the documentation 🙂

[@H_Raja]

@@AndyMaloneMVP thanks! Another question, if a user identity is deleted in home tenant, does the 2nd Account get deleted?

[@AndyMaloneMVP]

@@H_Raja as far as I know when you sync a user from another tenant. It creates a synced guest account in the destination tenant. This is dynamic and when the link is disconnected, the users are deleted. Like I said, as far as I know. Again, I would refer you to the documentation on docs.microsoft.com

[@degblo12]

any idea if this could work with AVD?

[@AndyMaloneMVP]

The client doesn’t matter. It’s user authentication that matters, so whether you’re coming in from a physical or virtual desktop is irrelevant.

[@AndersBergqvist]

Is it possible to map user groups from the source tenant to user groups in the destination tenant? Security groups and/or O365 groups.

[@AndyMaloneMVP]

As you can appreciate this is a new technology. I will check out the Microsoft documentation listed.

[@entrasynchronization]

You can use a group to determine which users will be provisioned. Provisioning group objects across tenants currently isn't supported.

[@patriciajaraba8121]

thanks, Andy for sharing this video, I followed all the steps, but I haven't been able to synchronize user groups. some say it's possible, while others claim it is..¿any updates on this matter? @@AndyMaloneMVP

[@AndyMaloneMVP]

Officially groups are not supported at the moment as it’s currently in beta. However, watch out for more information soon.

[@maheshkumarnaik754]

is that required p2 license both the organization

[@AndyMaloneMVP]

P1

[@AndyMaloneMVP]

P1

[@moussifer]

Can this be used for inter-tenant sharing of meeting rooms?

[@AndyMaloneMVP]

Honestly, I don’t know. I’d submit a Q to the product teams.

[@moussifer]

@@AndyMaloneMVP how do i submit question to product team?

[@AndyMaloneMVP]

@@moussifer if you don’t have an agreement with Microsoft. A great place to get support from is the Microsoft tech community. Alternatively to learn, I strongly recommend that you visit and learn.microsoft.com. It’s packed with training materials and learning documentation you will find invaluable. I wish you the very best of luck, Andy

[@ServerOutSourcer]

Does it sync passwords if you provision as members?

[@AndyMaloneMVP]

No it’s a collaboration tool. I’d take a look at the documentation 😊 learn.microsoft.com/en-us/azure/active-directory/multi-tenant-organizations/cross-tenant-synchronization-overview

[@entrasynchronization]

Cross-tenant synchronization creates B2B users, so no password synchronization is required. The user will continue to authenticate in their home tenant.

[@jimmya9579]

Is your question at 13:00 not a yes as seen at 09:50 ? just delete the attribute mapping no?

[@AndyMaloneMVP]

Corect :-)

[@etiennebikatal7262]

Hello sorry what are the exams to follow to be mvp

[@AndyMaloneMVP]

There are no exams. It’s by invitation only. Check out my MVP video

[@RedneckIrishman]

How easy would it be to detangle a sync? Let's say if an arm(Tenant) of the business got sold off? No One wants the job of decluttering! 😊

[@AndyMaloneMVP]

It's dynamic. When you delete org. It will delete guest users. Or so I believe. Remember this is a preview.

[@RevuitNet]

If they can make the process of two way sync and make it as stress free and easy as possible… why have they made cross tenant/tenant to tenant migration sooo difficult. Surely they could leverage this to make that an easier job… Tenant to tenant migration should be as easy as IMAP migration.

[@AndyMaloneMVP]

Don’t be confused by migration versus synchronisation. This is not a migration feature. This is used for collaboration.

[@RevuitNet]

@@AndyMaloneMVP no, I’m aware but I feel the tenant to tenant migration is so neglected… it’s classic with Microsoft lately… they try to inovate new things before they fix things which are broken or don’t work well… the tenant to tenant migration is needlessly complicated and even though the endpoints match making it tricky for them… a company trading at this level with as many small businesses right up to large enterprise really should figure this stuff out before creating more tools… Microsoft… fix what’s there first before you add more.

[@AndyMaloneMVP]

I agree with you unfortunately it’s up to 3rd parties at the moment to provide a decent service. Share gate does a pretty good job. Other than that I’m afraid you’ll have to shop around. Good luck though. Let me know how you get on.

[@RevuitNet]

@@AndyMaloneMVP Your right there Andy but sadly it’s the one migration others know Microsoft don’t support well so they all charge! I’ve yet to find a good free 3rd party or supported solution. 😞

[@badisthebest]

He's very hard to hear

[@AndyMaloneMVP]

Sorry we tried our best

[@philtierney4717]

Video is only ok. It takes an assumption that you the viewer knows something already.... like... for those, ME , that have no knowledge at all of what this all is then this teaches you nothing. Like... B2B ? What is a Tenant ? What is cross tenant ? etc etc... so , an average video for a video that says.. First look !!

[@AndyMaloneMVP]

Hi Phil, I understand your point very well. This video is exactly as it was meant to be though a first look at a particular topic for experienced users. I’m sure as time goes on I will develop a how to video. This was a session where I had a meeting online with the product group member who was kind enough to demo the product. This is extremely rare and for one I’m very grateful he did. Many of my videos focus on “the beginner“ and I hope that you’ll find something of use on my channel. Beyond that, of course you could always take paid training, thanks again and all the best, Andy