Blog
What is a multi-tenant organization (MTO)?
Effective collaboration across tenant boundaries is a critical success factor for companies today. End users must be able to use apps and documents seamlessly.
The Multi-Tenant Organization feature in Microsoft 365 does exactly that: It facilitates collaboration between different Microsoft tenants without compromising the separate management of each tenant. Employees are granted access to Microsoft 365 and third-party applications, as well as documents located outside their own tenant.
A multi-tenant organization consists of a primary tenant (owner) and at least one associated tenant (member). A connection is established between these tenants, through which users – with predefined attributes if needed – are synchronized.
Core features of MTO
User synchronization
Invited users are first created as guest users. In general, they have fewer rights than users with the “Member” role.
With multi-tenant synchronization, users do not need to be migrated, recreated, or invited as guests. Cross-Tenant Synchronization automatically synchronizes all or selected users from Tenant A to Tenant B. The user attributes to be transferred are defined in advance and transferred to the partner tenant based on Entra ID. In addition to the name, UPN and department, “extension attributes” can also be synchronized. These attributes can be used to assign users to dynamic groups in the partner tenant. Dynamic group memberships make it much easier to assign permissions to synchronized users.
Accounts that have already been invited can be upgraded to full members at a later time.
Collaboration across tenants
After a merger, for example, it is essential that users from two tenants are able to work together. In a pure B2B collaboration or B2B direct connect configuration, users are often invited just as guests. Since they have limited permissions in the partner tenant, an additional user account is created.
This means that each user has two accounts in a tenant, both of which are displayed in “People Search.” However, each person is logged into only one of these accounts at a time and receives only the messages sent to that account. To be able to view all messages, you would have to log in repeatedly. In a multi-tenant organization, however, users access resources exclusively through their accounts in the source tenant.
Inbound and outbound B2B collaboration and B2B direct connect rules are defined for collaboration between companies. They determine which users, groups, or applications are granted access.
Benefits of B2B collaboration and direct connect in a multi-tenant organization in M365:
- Teams: Users can hold meetings, chats, and calls across tenant boundaries without having to manually switch accounts in the respective app.
- Outlook: Users can view the free/busy entries of colleagues from partner tenants.
- People search: There is a unified search for colleagues across all connected tenants, with only one result per person.
Security and management
Managing data and resources is subject to the applicable country-specific data protection requirements. In a multi-tenant organization, resources and users continue to be managed by the existing IT departments. The administrative burden is lower since there is no need to develop complex solutions for data processing and resource utilization.
Synchronization can be configured and customized in the Microsoft 365 Admin Center. At least one Entra P1 license is required to make changes to the trust relationship between two tenants.
Tenant partners may hold positions of trust. In the B2B configuration, certain trust relationships for the source tenant can be enabled, such as MFA or device security. If the source tenant is not trusted, the conditional access policies of the user’s own tenant apply to the person logging in.
Typical MTO use cases in Microsoft 365
1. A corporate group with several subsidiaries
An international corporate group operates several independent subsidiaries, each of which uses its own Microsoft 365 tenant. This has a clear advantage for employees: They can communicate with each other directly, without needing additional guest access. The respective IT department manages the security policies and handles user administration. This improves collaboration across the group, ensuring that company-wide standards and compliance requirements are met.
2. Merger of two companies
When two companies merge, they often face the challenge of integrating their existing IT infrastructures, processes, and employees as quickly as possible. With a multi-tenant organization, both companies can initially keep their existing tenants while still benefiting immediately from close, cross-company collaboration.
Immediately after the merger, employees from both companies will be able to communicate with each other via Teams, Outlook, and SharePoint and start projects without having to wait for complex and time-consuming tenant migrations. In a multi-tenant organization, they can easily find relevant contacts, documents, and resources throughout the entire new corporate group, regardless of their original company affiliation.
A later migration and standardization of IT structures can be implemented flexibly in subsequent phases without disrupting ongoing business operations.
3. Efficient collaboration through Exchange Free/Busy and Teams Shared Channels
In an organization with multiple locations or independent departments, each of which operates its own Microsoft 365 tenant, seamless collaboration is essential. Integration of Exchange Free/Busy features allows employees to view the availability of everyone in the corporate group and schedule meetings across calendars, regardless of their own tenant.
In addition, Teams Shared Channels facilitate seamless communication in shared channels. Guest accounts or constantly switching tenants are not required. Project-based groups or cross-functional teams can collaborate on documents, chat, and hold meetings. This promotes flexibility and speed in collaboration without compromising security or compliance.
This might interest you
- Blog
- Blog
- Blog