ADFS with multiple office 365 tenants

[willtech]

Not sure if any one is doing this but we have a single ad forest each site is separate in a ou and want to use ADFS with our schools in the ad but we have separate office 365 tenants can we use this with a single ADFS instance or would I have to have a separate ADFS for each site ?

[rich_tech]

Its been a while since I brought stuff into our ADFS setup here, this document helps explain what is and isnt possible to do with MS office365 and azure ad sync which I think is what your looking at similar to us.

 

If your office365 account only has one tenancy you need to go down the one adfs for all route similar to us here with 2 domains I believe and you have the one adfs setup sync all to office365

 

https://docs.microsoft.com/en-gb/azure/active-directory/hybrid/plan-connect-topologies

Edited March 31, 2019 by rich_tech

[Katy]

Do you have one forest, or one domain?

 

One forest, with a domain per school, you can have one or multiple ADFS servers: one per domain, authenticating the users for that domain only, or one in the forest root domain authenticating anybody in the forest.

 

We have one forest but multiple domains (one domain per school) and are currently thinking about migrating away from one ADFS per domain to a central forest root domain setup.

[chaplic]

My first point would be 'dont use ADFS'. There's very little reason to do so these days, use password hash sync and seamless SSO

 

So if you have multiple tennants you presumably have multiple AzureADConnect instances too?

 

I've seen a lot of odd setups, but that's a first. I can't think of a reason why this couldn't work, but I'd definetly be testing it with two O365 tennants and a spare domain in both.

[willtech]

Thank you everyone. Sadly due to the setup with on forest and 9 office 365 tenets would would have gone azure seamless sign on but microsoft does not allow us to run it in the way our AD is. Yeah multiple AzureADConnect on each site.