Azure ad Password write back one Ad domain - two Azure tenants?

Question

Hello,

We configured two Azure AD Connect servers synchronising different user OUs to different azure tenants. Each user object is synhronized only once via Ou filtering and based on distinct UPNs.
We want to enable SSPR on both Azure tenants.

Can you please confirm that SSPR from different tenants will work against the single on prem AD domain as long as each Azure connect service account has appropriate permissions on the OUs filtered for each of the tenant ?

Thank you,

Answer 1

SSO is disabled. Synch for devices only to one tenant.

According to documentation AD Connect accounts need permissions for (password) writeback:
Reset password
Write permissions on lockoutTime
Write permissions on pwdLastSet
Extended rights for "Unexpire Password" on the root object of each domain in that forest, if not already set.

We want to limit each AD connect account to a subset of the OUs as per the filtering configured during AD connect config.

It should work but if anyone validated already a similar scenario it will be great having feedback.

Answer 2

Hi, did this end up working?