Federate 2 Azure tenants to access 1 Azure DevOps instance

Timothy Robnett 96

A consulting company and their client have federated their directories to allow MS Teams, MS Exchange and other Office 365 Collaboration tools to function seamlessly. The consultants now need access to the clients Azure DevOps instance. The client initially setup Guest accounts in their Azure AD for the consultant but this caused numerous issues for the consultants and their access to their own instance of DevOps in their own tenant.

Is there are an article on how to federate the two tenants so that select users of Consultant.com can be granted access to Client.com's Organization and select projects within that organization?

Accepted answer

Timothy Robnett 96 Reputation points

2020-08-20T18:54:14.217+00:00

I was able to switch directories. Very cool - that is pretty close to what I expected to find. A little more testing to ensure all is good but I think it is functional now and makes sense. No idea what happened before and why it disconnected me from previous projects that I was even one of the two admins on.

Thank you again.
Please sign in to rate this answer.
Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,326 Reputation points

2020-08-20T18:56:35.097+00:00

You're welcome and thank you too.
Sign in to comment

1 additional answer

Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,326 Reputation points

2020-08-19T22:00:42.14+00:00

Currently that's not possible. An Azure Devops Organization/instance can be connected to just one Azure AD tenant.

--
Please let us know if this answer was helpful to you. If so, please remember to mark it as the answer so that others in the community with similar questions can more easily find a solution.
Please sign in to rate this answer.
Timothy Robnett 96 Reputation points

2020-08-19T23:18:55.29+00:00

So the only solution is to use two browser instances, each with a separate cookie that identifies you as a separate identity to the Microsoft suite of applications?!?!? I should point out that this potential "solution" means that hyperlinks from Outlook are effectively broken as you can only have one default browser. Furthermore, this would also seem to imply that if you had more clients that needed you in their DevOps instances regularly than you could locate unique browsers, you'd just be out of luck. Surely there has to be a better solution, right? If not, perhaps we can vote up a request to the Product Owner of DevOps to look into what I see as a gap.

Thank you Alfredo for the response. Perhaps it is just me but this seems like a sizeable gap.

Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,326 Reputation points

2020-08-20T14:56:57.347+00:00

@Timothy Robnett b2b collaboration, as you already tried, is the way to go. What were the issues encountered? Also, It's not clear to me the need for the described "solution". Can you please provide more detail of the current federation setup?

Timothy Robnett 96 Reputation points

2020-08-20T15:41:07.33+00:00

Alfredo, that was done, my account was added and invited to Client.com's Azure AD and was added to the Azure DevOps project. I accepted it by clicking on the URL. I was then prompted to logon with my account (which was already cached because I was logged in). I was taken to my organizations sign-on page complete with my company's logo. After signing on again, I was prompted through a process to setup another MFA token in my Microsoft Authenticator app. I found this odd but continued and was eventually able to see the client's shared content in DevOps. When I tried to go back to my organization's DevOps instance, I was prompted to create a new organization and once signed in I had lost all access to my organizations projects. My orgainzation's admin re-added me to the projects in DevOps I had been on before but I could no longer see my client's projects.

Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,326 Reputation points

2020-08-20T17:14:19.51+00:00

Sorry to hear that. If you created a new organization you would've had no access to others organizations projects. I just tried to see if any issue arises and found none. Once you accept the invitation you get added to the client tenant and devops instance and can switch efortesly between tenants clicking on the account avatar (top right corner) and on "Switch directory". Was the latter the method used to go back to your DevOps instance?
Sign in to comment