Evaluating Azure Cross-Tenant Synchronization: Benefits and Concerns

Question

There is interest in the Azure Cross-Tenant Synchronization feature and its potential benefits for managing four tenants. While many articles outline the advantages, there are concerns that need to be addressed:

1. How are users with devices not enrolled in Intune from one tenant (child) affected when accessing a tenant with active Conditional Access Policies (CAPs) (primary)? Does the synchronization take precedence over the CAPs?
2. Are there any impacts on guest user (B2B) access?
3. How does this synchronization affect existing SharePoint and OneDrive sharing access? Are the sharing settings still applicable?
4. When synchronizing identities, is there granular control over what gets synced and to which resources?
5. The known issues section mentions problems with special characters. Have there been any issues in child tenants located in the EU, Africa, and China that use these characters?

Any shared experiences with this feature would be appreciated.

Answer 1

1. How are users with devices not enrolled in Intune from one tenant (child) affected when accessing a tenant with active Conditional Access Policies (CAPs) (primary)? Does the synchronization take precedence over the CAPs? There are two things 'Cross-Tenant Synchronization' and 'Cross-tenant access settings'. Cross-tenant synchronization enables you to automate provisioning/de-provisioning identities (B2B users) across tenants in your organization and simplify collaboration within your organization. Cross-tenant access settings are intended to manage collaboration with external Microsoft Entra tenants. In the last one you control if you trust device compliance from the other tenancies (Entra ID > External Identities > Cross-tenant access settings > Inbound access settings - <organization name> > Trust Settings). If you are using CA policies that evaluate device compliance you may need to make sure the device is marked as compliant in its home tenant (you can use Intune, but also any other MDM supported by Entra ID).
2. Are there any impacts on guest user (B2B) access? 'Cross-Tenant Synchronization' just automates the provisioning of identities (B2B users), and it does via B2B collaboration. So it literally creates these guests accounts for you based on parameters you decide (like being member of a group). And provides some attribute mapping capabilities (Mappings) that allow you to define how data should flow between your tenant and the target tenant.
3. How does this synchronization affect existing SharePoint and OneDrive sharing access? Are the sharing settings still applicable? Existing Sharing policies and settings apply in all the Microsoft 365 services (SPO, Teams, OD, 365 Groups), so you need to make sure these services support sharing with existing guest accounts at least after you activate the T2T synchronization.
4. When synchronizing identities, is there granular control over what gets synced and to which resources? You would like to control who gets replicated (via group membership), but access to resources is controlled at the resource level. Meaning, you will need to provide access specifically to each resource, or restrict sharing with guests if needed.
5. The known issues section mentions problems with special characters. Have there been any issues in child tenants located in the EU, Africa, and China that use these characters? I have no specific insights on this.

Check the following references:

• https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview
• https://learn.microsoft.com/en-us/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-configure
• https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-settings-b2b-collaboration

I hope it helps.

Answer 2

Thank you. This was indeed most helpful.

Regarding question 2, we have users from the child tenants that were issued primary tenant UPNs in order to satisfy our tenants Duo IDP (they use MSFT MFA) and collaborate via Teams, does everything remain in place with those accounts? I would have thought their child tenant user primary tenant UPNs would no longer be required once T2T sync is active. If that's the case, would we have to grant access to the primary tenant resources using their child tenant UPNs?