One on-premis AD, multiple AAD tenants

Question

Hi all

We sync a single on-premise AD to multiple Azure AD Tenants. According to https://learn.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-topologies this scenario is supported. But I have some questions:

1. When we configure PTA for this scenario we need a PTA agent (or two for redundancy) installed for each AAD tenant is that correct?
2. What does "Windows 10 devices can be associated with only one Azure AD tenant." mean? It's not possible to have a device in multiple tenants or you can only register devices to one of the tenants and device registartion in the other tenants is not possible?
3. "The single sign-on (SSO) option for password hash synchronization and pass-through authentication can be used with only one Azure AD tenant.". I understand this means SSO can only be configured for one Tenant. Is that right?

Thank for feedback.

Answer 1

Hi @Tobi ,

1 - Yes, you need at least one for each tenant.

"Pass-through Authentication is a tenant-level feature."

It's associated with Azure AD Connect as well, and Azure AD Connect has a 1:1 relationship with the Azure AD tenant. https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta-quick-start

2 - It means that the same device object cannot exist in more than one tenant and cannot be registered in multiple Azure AD tenants. When you register a device it creates a device object in Azure and maps this to the user account. If you want to join a machine to a different tenant, you need to disconnect from the first tenant and register again with the new tenant.

3 - "The single sign-on (SSO) option for password hash synchronization and pass-through authentication can be used with only one Azure AD tenant." This means that you can't have multi-tenant/cross-tenant single sign-on for password hash synchronization and pass-through authentication.

Answer 2

Hi @Shashi Shailaj @Marilee Turscak-MSFT

I was reading this thread. I wanted to summarize and validate one point. Appreciate your help.

So we know that any Windows 10/11 device can be joined to only one AAD-tenant.
The device could be AAD-joined OR Hybrid-joined or AAD-registered.

But once the device is joined to tenant T1, when user want to sign into the device , he must be in tenant T1
however, once user of T1 signs in, he can always add his 2 different accounts of Tenant T2 and T3 from
Settings --> Accounts ---> Email & Accounts --> Add Work or School Account

In other words, this device now has PRT of 3 accounts from 3 Tenants T1, T2 and T3
We will find the same device as "AAD-registered" in T2 and T3

Now if this user want to access any app registered in tenant T2, he will choose the account of T2 from account-picker popup.

Am I correct ?