To multi-tenant or not to multi-tenant ?

[mikkydoos]

Hi all,

 

Small academy trust here, 2 sites, both M365... with a third on the way.

 

We're been looking at brining our smaller school into our tenant and are weighing up the pros and cons of one big tenant for all schools, or a MTO model with sync set up across the tenants.

 

A big issue presently is having to perform configuration changes twice, Intune policies for example. We're maintaining two tenants of user groups, two backup processes, duplicate Sharepoint sites  etc etc etc. . . This will be a bigger pain when we are three schools.

 

However I do not relish having to migrate data and mailboxes etc from one tenant to the other.

 

 

What are your experiences of MTO?

Would you do it, have you done it and what are the pro's and cons to just having one big tenant ?

 

 

Would like to hear your experiences on this  👍

 

 

 

Cheers in advance     

 

 

 

 

 

[MatthewL]

If its all part of the same trust then yes it should be in the same tenant in my opinion. Cause you more headache not been.

[PotNoodleTech]

I would say yes bring them into one tennant.   Summer hols would be the ideal time to take a deep breath and get on with it - so start planning now.

 

If you've got full admin control of both tennants, it shouldnt be too bad.

[Boredguy]

MTO is a great stepping stone for easy integration/resource access, but doesn't beat migrating it all into 1 tenancy to reduce duplication.

 

We setup MTO for our Trust since the logistics of getting 7 schools migrated across into a single tenancy kept getting harder to deal with since all our devices are in InTune so need rebuilding, plus we moved to Teams telephony so would need that migrated over... and summer has been busy enough the last few years.

[mikkydoos]

3 minutes ago, Boredguy said:

MTO is a great stepping stone for easy integration/resource access, but doesn't beat migrating it all into 1 tenancy to reduce duplication.

 

We setup MTO for our Trust since the logistics of getting 7 schools migrated across into a single tenancy kept getting harder to deal with since all our devices are in InTune so need rebuilding, plus we moved to Teams telephony so would need that migrated over... and summer has been busy enough the last few years.

 

Thanks @Boredguy

 

How does that work out for you regarding file sharing, Sharepoint & Teams access. Is it pretty seamless for users?

 

I'm considering MTO as the 2nd and 3rd school are primary's and I would prefer the user separation particularly between the kids.. also security is big consideration.

[Boredguy]

So far it's been very seamless.

 

I've only shared Staff accounts between the tenancies, so they all show as full members instead of "Guests" so adding them into Teams/SP sites means they get normal access the same as a member on your own tenancy.

 

On the Tenancy that holds our MAT CPD SharePoint site, I setup a Dynamic Group that used the "User.CompanyName" field, so that as long as our Staff have our Trust name in their AD field in School B, they can access the resource without requiring to sign in to that tenancy.

 

I've got another 3 schools to add to our MTO in a couple of months when they officially join us...  Takes about 5-10 minutes per site to set it up.. hardest part it logging into all the different ones to set the sync up between them all, so less you have the easier it is.

 

There was meant to be a limitation that you could only setup 5 Tenancies in the MTO without contacting MS... so far I've got 8 interlinked Tenancies without any problems.

[Rob_D]

It might not be a problem if it's not going above a handful of small schools, but the more the MAT expands (with a single tenant) the more chance you have of running up against Microsoft's storage limits.

 

[Boredguy]

11 minutes ago, Rob_D said:

It might not be a problem if it's not going above a handful of small schools, but the more the MAT expands (with a single tenant) the more chance you have of running up against Microsoft's storage limits.

 

If you have the A3 licences, not really an issue since your limit increases per licence... If your just using A1 then yes it can be a restricting factor

[mikkydoos]

On 29/04/2025 at 09:57, Boredguy said:

So far it's been very seamless.

 

I've only shared Staff accounts between the tenancies, so they all show as full members instead of "Guests" so adding them into Teams/SP sites means they get normal access the same as a member on your own tenancy.

 

On the Tenancy that holds our MAT CPD SharePoint site, I setup a Dynamic Group that used the "User.CompanyName" field, so that as long as our Staff have our Trust name in their AD field in School B, they can access the resource without requiring to sign in to that tenancy.

 

I've got another 3 schools to add to our MTO in a couple of months when they officially join us...  Takes about 5-10 minutes per site to set it up.. hardest part it logging into all the different ones to set the sync up between them all, so less you have the easier it is.

 

There was meant to be a limitation that you could only setup 5 Tenancies in the MTO without contacting MS... so far I've got 8 interlinked Tenancies without any problems.

@BoredGuy

 

I'm trying to set up MTO currently and am hitting a wall syncing the users. I can't save provisioning settings in Azure (Cross tenant synchronisation / Configurations).  

 

Save button is greyed out ??

 

Could this a license issue - We're on M365 A3.

 

Cross tenant requires P1 or P2 in the docs.

 

Any idea ?

 

 

Cheers  👍👍👍

[Boredguy]

We are on M365 A3 licencing and that includes P1 for us.

Are you setting up the user sync via Settings - Microsoft 365 admin center and not within Azure itself?

You might find setting it to sync a single user first, then going into the Cross Tenant Sync config to update it to be a specific group

[mikkydoos]

17 minutes ago, Boredguy said:

We are on M365 A3 licencing and that includes P1 for us.

Are you setting up the user sync via Settings - Microsoft 365 admin center and not within Azure itself?

You might find setting it to sync a single user first, then going into the Cross Tenant Sync config to update it to be a specific group

Exactly what I've just done... and its created the provisioning profile now which I can edit, edit attributes etc.

 

Loads of thanks @BoredGuy.   Got it syncing now 👍👍👍

[armadillo]

I've started to look at having trust tenant so users can collaborate better and share resources on access teams, SharePoint etc.

Can you please list of benefits and negatives of having either of the two options All sub tenants migrated onto one central tenant versus MTO tenants sync?

Hopefully you won't mind me starting this threat again.

Thanks in advance

[cw80]

One thing to be away of with single tenant option is the education storage limit of per tenant and a small amount extra per staff so with multiple groups in one tenant that limit is more likely to affect you and it is costly to add more storage (around. £4000 a year per extra 10TB)

[nicholab]

Also, you will save on licensing, as some staff may need a license in multiple tenants to do certain tasks.  Also means that any SEIM solution is easier as well.  Also your backup of Office 365 will be easier as well.  If you need to build resources in Azure and bill them to certain schools, you can create a subscription per school.

[armadillo]

Thank you @cw80 and @nicholab for your replies, very helpful.

Any more views would be welcome and thanks in advance.

Thanks

 

[armadillo]

On 12/05/2025 at 15:37, mikkydoos said:

Exactly what I've just done... and its created the provisioning profile now which I can edit, edit attributes etc.

 

Loads of thanks @BoredGuy.   Got it syncing now 👍👍👍

HI, sorry for starting this thread again. Can you please let me know how you found using MTO with sync with other tenancies enabled; did it solve the  issues with seamless access you had before and also any pitfalls? I'm not convinced which route to take yet and still looking into it, MTO or full migration from 5 x tenants to a single trust tenant.

 

Thanks in advance.

[mikkydoos]

MTO sync works perfectly for me.

 

Set up the sync profile between the two  (or 5 in your case).  Sync in your desired security groups...

We're getting seamless access to Teams, Sharepoint, address lists, OneDrive shares, permissions etc.

Works a charm.

 

Not sure how this would work with 2+ tenants.  One tenant needs to be the master so not sure how (if tenant 1 is your master) how users would sync out to 2,3,4,5,  if this can be done at all.

 

You might need to set up lots of sync profiles for all tenants to sync out to each other.

 

Edited December 2, 2025 by mikkydoos

[Rob_D]

4 minutes ago, mikkydoos said:

Not sure how this would work with 2+ tenants.  One tenant needs to be the master so not sure how (if tenant 1 is your master) how users would sync out to 2,3,4,5,  if this can be done at all.

 

You might need to set up lots of sync profiles for all tenants to sync out to each other.

If I remember correctly (and it's been several years, so it might have changed anyway), each tenant syncs with your master, so tenant 1 (the master) has all the groups for all the others, and tenants 2-5 sync all the groups from 1, including each other's groups. 

[armadillo]

Thank you @mikkydoos @Rob_D for you messages very helpful.

I'm being told that MTO setup doesn't solve the seamless collaboration challenge faced by multiple tenants setup; Can you also let me now if your users can see search address books from other tenants for when sharing resources and also in chat? This is one of the issues mentioned to me when I spoke to a consultancy company, I started to now think they only want the more complex, full migration of all tenants to one tenant, and larger project for their financial gain.

 

I'm just trying to compare the two setups MTO vs full tenant migration to a central tenant, to make sure we don't end up not solving the issue of seamless file sharing, collaboration in Teams and seamless access to re]sources

 

Thanks a lot

[mikkydoos]

Yes you can see users from other tenants. This is set in the master tenant if I remember correctly and you can pick and choose groups of users to display, and where.

You can also crreate attributes to amend the display name when searching the directory from other tenants.

 

E.g.  school1 - Fred Smith

 

 

Best thing you could to is set up a test group and create MTO between two tenants and see if it does what you need.

 

EDIT:  I think I followed this guide for quick reference... plus a bit of reading....    

 

 

 

EDIT 2:  After you set the basic sync, there are a lot of settings in Entra Admin to fine tune how you want it to operate.

Edited December 4, 2025 by mikkydoos

[armadillo]

20 minutes ago, mikkydoos said:

Yes you can see users from other tenants. This is set in the master tenant if I remember correctly and you can pick and choose groups of users to display, and where.

You can also crreate attributes to amend the display name when searching the directory from other tenants.

 

E.g.  school1 - Fred Smith

 

 

Best thing you could to is set up a test group and create MTO between two tenants and see if it does what you need.

 

EDIT:  I think I followed this guide for quick reference... plus a bit of reading....    

EDIT 2:  After you set the basic sync, there are a lot of settings in Entra Admin to fine tune how you want it to operate.

 

Thank you for your input on this. I will watch the video to gain an insight into it all. Thanks

 

[armadillo]

On 29/04/2025 at 09:57, Boredguy said:

So far it's been very seamless.

 

I've only shared Staff accounts between the tenancies, so they all show as full members instead of "Guests" so adding them into Teams/SP sites means they get normal access the same as a member on your own tenancy.

 

On the Tenancy that holds our MAT CPD SharePoint site, I setup a Dynamic Group that used the "User.CompanyName" field, so that as long as our Staff have our Trust name in their AD field in School B, they can access the resource without requiring to sign in to that tenancy.

 

I've got another 3 schools to add to our MTO in a couple of months when they officially join us...  Takes about 5-10 minutes per site to set it up.. hardest part it logging into all the different ones to set the sync up between them all, so less you have the easier it is.

 

There was meant to be a limitation that you could only setup 5 Tenancies in the MTO without contacting MS... so far I've got 8 interlinked Tenancies without any problems.

HI @Boredguy

I've looking at having trust tenant so users can collaborate better and share resources on access teams, SharePoint etc.

Can you please list any pitfalls and advantages you've experienced with your MTO setup, as I'm more leaning towards MTO rather than All sub tenants (6 in total) migrated onto one central trust tenant

Thanks in advance

[Boredguy]

I'm up to 8 Tenancies linked to my MTO without any real issue (still got at least 2 more to do shortly)

 

It can be a bit of a pain on the initial setup for each one having to connect to each Tenancy to share the users/setup the connection but doesn't take too long.

Got caught out on the recent tenancy as it doesn't sync company name by default with the new preview settings, so had to add it to the attribute mapping, but otherwise it works nicely.  Users happily able to access Teams/SharePoint as full members so can access our CPD resources, and they appear in the address book for users.

 

Am thinking about making sure we have new Address book policies for students so they don't get the other school staff available to search for

[Boredguy]

Also you can have different users syncing with the other sites.. .it's not just a case of everything goes up to the master and then cascades down.

If you want all Staff at site 2 to go to the Primary and Site 3, but then you also want a group of students (say sixth form) to also sync with site 4 you can adjust the permissions just on that 1 sync

[simpsonj]

29 minutes ago, Boredguy said:

I'm up to 8 Tenancies linked to my MTO without any real issue (still got at least 2 more to do shortly)

I thought it was limited to 5 tenancies? 

 

If that isn't the case, then this could be exactly what I'm looking for!