To multi-tenant or not to multi-tenant ?

[Boredguy]

It's recommended for 5, but so far I've not hit a limit

[armadillo]

@Boredguy thank you very much for the information and for the tips. It's been hard for me to decide whether to go for MTO or complete migration of 6 x tenants to a central trust tenant, each consultancy company I spoke to to they all pushed for the migration to a central tenant, which made it confusing and more difficult for me to make an informed decision. Thanks for your insight to the MTO setup, which is comforting to hear it's all working as you expected it.

[Boredguy]

As others have mentioned, it also saves on the overall storage limit.

Yes you get more for each A3 or above licence you buy, and there is nothing to say you can't start with the MTO then go down the migration route later since there isn't a cost implication other than your time to set it up as long as it's activated in the tenancies with the correct licence.

[armadillo]

15 minutes ago, Boredguy said:

As others have mentioned, it also saves on the overall storage limit.

Yes you get more for each A3 or above licence you buy, and there is nothing to say you can't start with the MTO then go down the migration route later since there isn't a cost implication other than your time to set it up as long as it's activated in the tenancies with the correct licence.

Good point re storage benefits with MTO setup. I guess they all need to be on A3 licence for MTO to work properly and take advantage of storage which comes with it?

[Boredguy]

One of my sites only currently has a single P1 licence which enabled the MTO setting, and all the users are still on the free A1 licences and the 100Gb storage limit per user that is has.

 

Once we upgrade them to A3 licences next month, the user limit goes up to 1Tb per user.

[pete]

@Boredguy How much (if any) cleanup work did you have to do with guest accounts from Tenant02 that have access to resources in the main tenant? 

 

MS documentation states that a second "real" account is created and then you manually clean up the "guest" account and everything will be fine (tm). 

 

Does that match your experience?  

[armadillo]

I also meant to add as well as creating MTO across 4 schools tenants, we are planning off adding an exra tenant for trust central staff to use, it will also be used for trust file and information sharing with other schools using SharePoint sites and Teams; have any of you have this sort of setup?

Thanks on advance.

[Boredguy]

On 18/02/2026 at 18:18, pete said:

@Boredguy How much (if any) cleanup work did you have to do with guest accounts from Tenant02 that have access to resources in the main tenant? 

 

MS documentation states that a second "real" account is created and then you manually clean up the "guest" account and everything will be fine (tm). 

 

Does that match your experience?  

I had a lot of accounts I had to go and edit some tenancies where staff had been invites to Teams prior to the MTO being setup so they were just "Guest" accounts.  But didn't take long to find them and edit them and switch the drop down from Guest to Member.

 

I didn't bother deleting the guest accounts and having the sync recreate them, since just switching the drop down in Azure User manager was sufficient (and they were already in our MAT Team from a few years before)

 

Edited February 23 by Boredguy

[Boredguy]

On 19/02/2026 at 09:11, armadillo said:

I also meant to add as well as creating MTO across 4 schools tenants, we are planning off adding an exra tenant for trust central staff to use, it will also be used for trust file and information sharing with other schools using SharePoint sites and Teams; have any of you have this sort of setup?

Thanks on advance.

Basically yes as our new "MAT" tenancy is the the "Master" for the 10 schools ready for when we get round to migrating everyone to the single tenancy... so in the next few months I'll have 11 tenancies setup in the MTO

[armadillo]

45 minutes ago, Boredguy said:

Basically yes as our new "MAT" tenancy is the the "Master" for the 10 schools ready for when we get round to migrating everyone to the single tenancy... so in the next few months I'll have 11 tenancies setup in the MTO

@Boredguy thanks for your replies. Did you use a consultancy company to help you with MTO setup? I'm looking into this and if you had any tips etc. thanks

[mikkydoos]

I have a couple of users who are located in the master tenant who I'm trying to sync back to a member tenant.

 

These users just will not sync. They were guest users n the member tenant, I deleted them, removed them from the Entra 'bin', and they still won't sync.

 

This was two weeks ago. 

 

They still appear in the member tenant address list but I think they are left overs from the guest users... they appear without the applied attributes in the display name.

 

 

Has anyone come across this... and how did you solve it ?

 

 

[Boredguy]

I did it all myself @armadillo since it was quite straight forward

 

@mikkydoos From within Entra Identity, go to the Cross-Tenancy Sync option on the left hand menu (its near the bottom)

Go to Configurations and click on the GUID that matches the tenancy your exporting your users to.

You can check the users that are being sync'd over if you manually selected any, or groups.  If they are there, your next port of call is the Provisioning Logs to see if the user is appearing in there at all.

If not, select to restart the provisioning.

 

Within this section, I also go into the Overview section for each of my MTO sync's and go to "Map attributes (optional)" and select additional AD fields we are using to be sync'd over to the other tenancy, especially companyName

 

[pete]

Has anyone managed to do any if/then decision making with expression-based attribute mappings?

 

I've got a basic "When exporting from Tenant 02 to Tenant 01, suffix displayName with a two-character school code" expression to make life easier for Tenant 01 (we hire a lot of people with the same first names):

 

Append([displayName], " [XX]")

 

but for Tenant01 to Tenant02, I'd like to append a suffix based on the email domain, as I have 3 schools + MAT in Tenant01 and just slinging a MAT suffix isn't helpful for "who is Bob and which school are they at?" purposes.

 

Something like "if email domain = school01.tld, append AA, if email domain = school02.tld, append BB, if email domain = school02.tld, append CC, if mat.tld, append DD"

 

Edit: Expressions reference is here: https://learn.microsoft.com/en-us/entra/identity/app-provisioning/functions-for-customizing-application-data?toc=%2Fazure%2Factive-directory%2Fmulti-tenant-organizations%2Ftoc.json#examples

[mikkydoos]

On 23/02/2026 at 14:34, Boredguy said:

I did it all myself @armadillo since it was quite straight forward

 

@mikkydoos From within Entra Identity, go to the Cross-Tenancy Sync option on the left hand menu (its near the bottom)

Go to Configurations and click on the GUID that matches the tenancy your exporting your users to.

You can check the users that are being sync'd over if you manually selected any, or groups.  If they are there, your next port of call is the Provisioning Logs to see if the user is appearing in there at all.

If not, select to restart the provisioning.

 

Within this section, I also go into the Overview section for each of my MTO sync's and go to "Map attributes (optional)" and select additional AD fields we are using to be sync'd over to the other tenancy, especially companyName

 

Thanks @Boredguy

 

Everything seems to be fine.  I have other users configured in here that are syncing fine. I don't know whats going on with these two users ?????????? 

[Boredguy]

8 hours ago, pete said:

Has anyone managed to do any if/then decision making with expression-based attribute mappings?

 

I've got a basic "When exporting from Tenant 02 to Tenant 01, suffix displayName with a two-character school code" expression to make life easier for Tenant 01 (we hire a lot of people with the same first names):

 

Append([displayName], " [XX]")

 

but for Tenant01 to Tenant02, I'd like to append a suffix based on the email domain, as I have 3 schools + MAT in Tenant01 and just slinging a MAT suffix isn't helpful for "who is Bob and which school are they at?" purposes.

 

Something like "if email domain = school01.tld, append AA, if email domain = school02.tld, append BB, if email domain = school02.tld, append CC, if mat.tld, append DD"

 

Edit: Expressions reference is here: https://learn.microsoft.com/en-us/entra/identity/app-provisioning/functions-for-customizing-application-data?toc=%2Fazure%2Factive-directory%2Fmulti-tenant-organizations%2Ftoc.json#examples

We use school logos for peoples Profile picture/Avatars, so that can become a visual indicator for if they are in the MAT, or specific school, but also have the AD Company field filled in for the users so that also appears on peoples contact card (and I also use it to create a dynamic distribution list so we can easily e-mail all trust staff for stuff like our MAT Training days)

 

Had a quick look, and you in the Expression Builder I think this is maybe what you might be able to do.  Using the Company field, this returns the info you expect

 

IIF([companyName] = "YourMatName", Append([displayName], "(MAT)"), "")
IIF([companyName] = "SchoolBName", Append([displayName], "(School B)"), "")

[armadillo]

@mikkydoos, @Boredguy I'm planning to set up MTO between our schools (6 in total), so they could sync with a new Trust tenant (so 7th tenant). My question is did you set up sync between all schools or just from Trust Tenant and the other schools and if so how is this working?

 

Thanks in advance.

Edited February 27 by armadillo

[pete]

On 24/02/2026 at 20:57, Boredguy said:

We use school logos for peoples Profile picture/Avatars, so that can become a visual indicator for if they are in the MAT, or specific school, but also have the AD Company field filled in for the users so that also appears on peoples contact card (and I also use it to create a dynamic distribution list so we can easily e-mail all trust staff for stuff like our MAT Training days)

 

Had a quick look, and you in the Expression Builder I think this is maybe what you might be able to do.  Using the Company field, this returns the info you expect

 

IIF([companyName] = "YourMatName", Append([displayName], "(MAT)"), "")
IIF([companyName] = "SchoolBName", Append([displayName], "(School B)"), "")

 

Cheers, I've been looking at the Switch option instead as it looked a bit more maintainable.

 

Quite tempted just to get Salamander to rebuild and automatically suffix the displayName and save me a job (there's some existing suffixes that I also need to account for/strip out).

[armadillo]

Sorry to hijack this;

@mikkydoos, @Boredguy I'm planning to set up MTO between our schools (6 in total), so they could sync with a new Trust tenant (so 7th tenant). My question is did you set up sync between all schools or just from Trust Tenant and the other schools and if so how is this working?

 

Thanks in advance.

[Boredguy]

19 hours ago, armadillo said:

@mikkydoos, @Boredguy I'm planning to set up MTO between our schools (6 in total), so they could sync with a new Trust tenant (so 7th tenant). My question is did you set up sync between all schools or just from Trust Tenant and the other schools and if so how is this working?

 

Thanks in advance.

I started the process on the new Tenancy so it was the "Master" and joined School A to it and set up the sync both ways for selected user groups.

Then I added School B to the new Tenancy and did the same, but as there is was then 2 tenancies in the group, it gives you the option to share the same users with School A as well as the Master, which I did.

 

In the end once I had all our original 6 sites connected up at least to the Master, I went through all the tenancies and made sure they were set to sync with each other, so now I basically have 9 sites listed, and when I add the next 2 in a month or so time I'll have to go into each of the other 8 school sites and set the user sync back up to those new schools just to be 100% everyone can see/access resources on those tenancies if needed

 

[mikkydoos]

On 27/02/2026 at 14:16, armadillo said:

@mikkydoos, @Boredguy I'm planning to set up MTO between our schools (6 in total), so they could sync with a new Trust tenant (so 7th tenant). My question is did you set up sync between all schools or just from Trust Tenant and the other schools and if so how is this working?

 

Thanks in advance.

 

 

I have a two way sync between two of my tenants. The rest just syn into the master tenant.

I only sync users that need access to Sharepoint sites hosted in another tenant or that require sending to a limited distribution list for example.

 

It all depend which users   a) you want appearing in the global address list in each tenant   or b) what resources you want them to access.

 

I would personally just sync necessary users.

[armadillo]

@mikkydoos, @Boredguy thank you both.

@Boredguy how did you manage to set sync between school A and school B, is this config on Entra ready to be enabled or did you have to use a third party tool?

Thanks

[Boredguy]

Everything was done within the native Multi-Tenancy option.

When you add a tenancy, you can select which other ones to sync with, and even have different groups of users on your tenancy syncing with different ones.

 

As we use Teams Telephony, I've got 1 of our school tenancies that houses our MAT wide IT Team Call Queue now being shared with all the rest of the Tenancies so it appears in their user search, but I didn't pick to sync the accounts for that schools call queues for absence/reception.

The more complex you want the users/groups to share to be, the easier it is to complete that aspect within Entra's Multi-Tenancy option.  The initial setup is all done via the 365 Admin Org Settings

[armadillo]

11 hours ago, Boredguy said:

Everything was done within the native Multi-Tenancy option.

When you add a tenancy, you can select which other ones to sync with, and even have different groups of users on your tenancy syncing with different ones.

 

As we use Teams Telephony, I've got 1 of our school tenancies that houses our MAT wide IT Team Call Queue now being shared with all the rest of the Tenancies so it appears in their user search, but I didn't pick to sync the accounts for that schools call queues for absence/reception.

The more complex you want the users/groups to share to be, the easier it is to complete that aspect within Entra's Multi-Tenancy option.  The initial setup is all done via the 365 Admin Org Settings

Thank you for your reply and for explaining the process you used to set up sync between all schools. The reason I've asked about this is because the consultant I've been speaking to said it wasn't possible to set up sync MTO between all schools, but only between the main tenant and the other schools.

[mikkydoos]

3 minutes ago, armadillo said:

Thank you for your reply and for explaining the process you used to set up sync between all schools. The reason I've asked about this is because the consultant I've been speaking to said it wasn't possible to set up sync MTO between all schools, but only between the main tenant and the other schools.

You can sync back to the main tenant.  @Boredguy might be able to tell you about syncing between 'client' schools.  I'm only syncing 2 at the moment.

 

I'm pretty certain you can though.

 

[Boredguy]

The main sync is with the primary tenancy, but for each tenancy you add, you can pick what users (groups currently in preview) are shared with which other tenancies in your setup.