question

stavrosmitchell-6182 avatar image
0 Votes"
stavrosmitchell-6182 asked amanpreetsingh-msft commented

b2b direct federation between two azure ad tenant

Hello I am just curious i have a few questions from a customer
is there a way to do b2b direct federation between two azure ad tenant.
can you do a b2b direct federation between azure ad and and an on premise AD

thanks

azure-ad-b2b
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

amanpreetsingh-msft avatar image
0 Votes"
amanpreetsingh-msft answered amanpreetsingh-msft commented

@stavrosmitchell-6182, Please find answer to your questions below:

  1. B2B direct federation between two azure ad tenant: This cannot be done as the requirement for B2B direct federation is, the domain should not be added as a verified domain under any tenant within Azure.

  2. B2B direct federation between azure ad and and an on premise AD: This can be done with the help of ADFS server, provided the domain is not verified in any Azure tenant. Refer to https://docs.microsoft.com/en-us/azure/active-directory/b2b/direct-federation-adfs for more details.

If the domain you are trying to add using B2B direct federation is added as verified domain under any Azure Tenant, you will encounter error your_domain.com cannot be used for direct federation as it is a verified domain on an Azure AD tenant.


Please do not forget to "Accept the answer" wherever the information provided helps you to help others in the community.

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Would you know if there is a way possibly either by script to be able to verifiy if the user exists in Tenant B and if not cleanup the Guest B2B user in Tenant A

0 Votes 0 ·

There is no script readily available for this. I can give you some high level pointers for this:

  • Use Get-AzureADUser | Where-Object {$_.userType -eq "guest"} to get a list of all guest users in Tenant A.

  • In the output, if you see the userprinicpalname it should be in user_tenantB_com#EXT#tenantA.onmicrosoft.com.

  • You can then replace _tenantB_com#EXT#tenantA.onmicrosoft.com with @tenantB.com.

  • Compare the resultant list with users in tenantB, run Remove-AzureAdUser cmdlet for the users which no longer exists in that tenant.


0 Votes 0 ·