Cross Tenant Synch users (Member) authentication

Question

Question is related to the Cross Tenant synched users. With what UPN does an external user (userType is Member) logs into the Target Tenant of any app registered in the target tenant? The UPN created in the target tenant is something like "johndoe_targettenant.com#EXT#@sourcetenant.com". How does the authentication flow work? provided we are to enable "trust the MFA of source tenant" in the cross tenant synch settings.

Answer 1

Hi @Rakesh Singh ,when an external user (userType is Member) logs into the target tenant of any app registered in the target tenant, they will use their UPN from their home tenant (source tenant) to authenticate. The UPN created in the target tenant will be in the format of "johndoe_targettenant.com#EXT#@sourcetenant.com" as you mentioned, but this is only used for identification purposes within the target tenant.

For the authentication flow, when the user attempts to sign in to the app in the target tenant, the authorization endpoint requests a token for the application. The user's credentials are then acquired and verified for authentication. If the user has been granted access to the app through cross-tenant synchronization, the authentication request is evaluated against cross-tenant access settings in both the user's home tenant and the target tenant. If all access requirements are met, a token is issued to the user that allows them to access the app.

If you enable "trust the MFA of source tenant" in the cross-tenant synchronization settings, it means that the target tenant will trust the MFA claims from the source tenant.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James