Yeah it gets messy with multiple tenants, and there's only one Azure AD per tenant. You need licensing per account as the benefits of that license are applied on login - the account is an entity as Azure has no concept of a physical user and you can't "share" a license across tenancies or across accounts.
Where is your segregation of data and access control if a physical user has access to three different accounts? They can't see or access one while logged on as another, I guess.
The preferred way of implementing data access control is to use Role Based Access Control inside Azure. This can be applied to people, groups, resources and resource groups, and across multiple subscriptions. That's even easier to scale now with Azure Blueprints (in preview).
-Sonia
