In my work with large Microsoft 365 customers, I keep running into organizations with more than one Entra tenant. Sometimes a merger caused it, sometimes it's subsidiaries, and sometimes it's an old decision that nobody can easily undo. Once users need to work across several tenants on a daily basis, identity management and collaboration across those boundaries turn into a lot of administrative work. Cross-tenant synchronization in Entra ID has been available since last year, and it has proven very useful here. It provisions B2B users into target tenants automatically, which cuts down on the mess of guest invitations and manual onboarding.

Configuration always starts in the source tenant

You set things up in the source tenant, in the Microsoft Entra admin center under External Identities → Cross-tenant synchronization. This is where you create the sync relationships to destination tenants. Two prerequisites matter most. The cross-tenant access settings in both tenants have to explicitly allow user synchronization ("Allow users sync into this tenant"), and automatic redemption has to be enabled in the target tenant. If it isn't, the sync fails during onboarding. For step-by-step details, the Microsoft overview of cross-tenant synchronization is a good reference.

You need Entra ID P1 licensing for cross-tenant sync. Most of the problems I see come up in organizations that already run B2B direct connect and guest setups (cross-tenant access settings). The permission and collaboration models overlap, so check your design carefully. The biggest point: cross-tenant sync creates B2B users as member, not guest, in the target tenant, and that can have a real impact on your access policies.

Scoping filters and attribute mapping keep provisioning under control

Scoping filters are one of the best parts of cross-tenant synchronization. They let you decide exactly which users get provisioned, for example only certain departments or users with specific attributes. Attribute mapping is very flexible too, so display names, email addresses and custom fields can be aligned properly. In larger organizations or migration projects, these mappings and filters need to be right, particularly when compliance and security requirements are involved.

A mistake I see often has to do with the UserType assignment. By default, synchronized users land in the target tenant as member, even if they were guests in the source tenant. Many Conditional Access policies for guests assume otherwise, so you have to handle this, either by changing the attribute mapping or by updating the policies.

I always test filters and attribute mapping with a small pilot group first, usually a dedicated group like “B2B-Sync-Test”. That way I can check entitlements, license assignment and Teams memberships in the target tenant without causing trouble in production.

Multitenant organizations extend the setup to Teams and Viva Engage

The multitenant organization (MTO) feature, launched this year, goes one step further with cross-tenant collaboration. With MTO, organizations can offer a consistent Teams or Viva Engage experience across several tenants, including a unified address book. For this to work, cross-tenant synchronization has to be configured correctly and all tenants have to authorize each other as MTO partners. The overview of multitenant organizations covers the details.

In day-to-day operation, watch these points closely:

  • Automatic deprovisioning: Users removed or deactivated in the source tenant should also be cleaned up in the target tenant
  • Licensing requirements: Synchronized users may need their own Teams or Viva licenses in the target tenant
  • Data and compliance: Data can move between tenants, so permissions have to be managed on purpose
  • Monitoring: You want to hear about provisioning failures or missing attributes early (Entra admin center → Monitoring)

Most sync problems come from inconsistent settings and deprovisioning

In real projects, a lot of sync setups fail because the cross-tenant access settings don't match. Often someone forgot automatic redemption in the target tenant, or the policies for direct connect and B2B guests contradict each other. The result is usually duplicate accounts, unexpected permissions or sync errors. If you already use Teams shared channels with B2B direct connect, go through all the related settings again (B2B direct connect).

Deprovisioning causes trouble again and again. When users leave or move from one subsidiary to another, the sync should remove them from the target tenant automatically. Still, test and monitor this regularly, because manual clean-up doesn't hold up at scale.

Practical tip: For every production rollout, use dedicated groups for scoping and validate deprovisioning thoroughly before you expand. Offboarding deserves the same testing effort as onboarding.

The diagram shows the basic cross-tenant sync flow

The diagram below shows a simplified scenario. A source tenant synchronizes selected users (from a subsidiary, for example) into a target tenant. Cross-tenant access and automatic redemption must be configured correctly in both tenants for this to work.

flowchart LR
  SourceTenant["Source tenant"] -->|"Synchronize users"| TargetTenant["Target tenant"]
  SourceTenant -->|"Cross-tenant access allow"| TargetTenant
  TargetTenant -->|"Automatic redemption"| UserProvision["Provision B2B user"]

Figure: The cross-tenant synchronization flow in Entra ID.

Automation helps, but governance decides the outcome

If you run several Microsoft 365 tenants, cross-tenant synchronization is a big step forward. Automated B2B provisioning, detailed attribute mapping and the MTO integration finally make secure and predictable collaboration possible across boundaries that used to be hard to cross. Without careful governance, a clear group structure and regular checks, though, things can go wrong quickly, and the difference between "member" and "guest" accounts is where it usually happens. If you keep an eye on those details, the next merger or rollout will be a lot less stressful.

If you want to read more about cross-tenant access and B2B direct connect, take a look at my earlier posts: cross-tenant access settings in Entra ID and setting up B2B direct connect for Teams shared channels.