Sync users from tenant A to tenant B both ways

[ramonabadea]

Hi everyone,

I am trying to find an easy solution for the following scenario:

I have tenant A and tenant B.
I would like to sync or copy all the users from tenant A to tenant B as guests. Easy so far.
The main problem is that I would need that every time when a user from tenant A is removed to automatically be removed from tenant B as well.

Does anyone have any idea of how this could be achieved in an easy way? 

Thank you,
Ramona

[#2]

The easy way would be to use third-party tools that specialize in this scenario. Those of course cost some $$$, so you might do it yourself instead via scheduled PowerShell scripts, Azure functions or whatever you preferred automation method is.

[#3]

The biggest challenge for "Do it yourself" scenario is to detect new or deleted objects in those two directories, especially for deleted objects. You either have a separate "internal" store that keeps track of objects (accounts) you synchronized previously (like Azure AD Connect has "metaverse") or you always need to query all objects and compare them across the directories.

If you are looking for a simple solution, I agree with Vasil you should look for a third-party tool.

[#4]

Hi Vasil, David,

Thanks a lot for your answers!

Do you have any points to add also for the more difficult scenario, such as the synchronized collaboration?

I have found a short description in the following article on global tenant topology when using synchronized collaboration on B2B https://aka.ms/multi-tenant-users but they mention a sync engine such MIM is used.

I hope I understand correctly, but now that you've mentioned Azure Connect metaverse, are you by any chance aware if it could be used for sync between cloud only tenants as sync engine?

[#5]

Hi @ramonabadea ,

I believe that AAD Connect uses MIM synchronization engine "under the hood" but the tool doesn't work for cross AAD tenant sync. If you choose to use MIM, as long as you have AAD P1 or P2 licenses (and a Windows Server OS license), you should be able to use it: https://azure.microsoft.com/en-us/pricing/details/active-directory/

The "Multi-tenant User Collaboration Patterns..." whitepaper talks about three distinct scenarios with different solutions. From your initial description I would think that the "Scripted collaboration" scenario (with Delta Queries, and MS Graph) would be a good fit for you, unless you require more advanced feature for M365. Or have you concluded you need those advanced features?

[#6]

Hi again David,

No advanced feature for M365 needed, the use case is very simple, just user sync between two different tenants.

I thought global tenant topology would be shorter in time to implement, but I think MIM is a tool that will be deprecated at some point or out of support anyways - found some article mentioned the end of this year.

So maybe, the scripted solution is indeed the only accessible...

[#7 · Accepted solution]

I would personally avoid using the "resource tenant" pattern if there are only two tenants in the picture, I like simplicity.

I am not aware of any plans to decommission MIM as a product but anyway, if I were you, I would explore the Scripted collaboration option and use e.g. Azure Functions (PowerShell) to implement this "push" automation using Delta Query.

[#8]

Thanks a lot for the recommendation and help, David 🙂

[#9]

A few years later from this post, Microsoft has finally released what we all needed!

For anyone who is hitting on this thread, please see THE EASY WAY:
https://learn.microsoft.com/en-us/azure/active-directory/multi-tenant-organizations/cross-tenant-syn...

[#10]

Better late than ever, right Ramona? 🙂
I like this new feature and we are planning to use it internally to sync between our PROD and DEV tenants.

[#11]

Please take into consideration that this feature still under preview and Microsoft still enhancing it so make sure to test in your test environment prior deploying it into production

[#12]

regarding Cross tenant Sync, check if user can use Office license from source tenant for all the activities on target tenant

[#13]

Can you actually detail a bit for what type of activities? It is an interesting scenario, for the moment we tested PowerBI, but it seems to be limited and you can't bring your own license from your "home" tenant. Did anyone else test any scenarios? 🙂