You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This article is the first in a series of articles that provide guidance for configuring and providing user lifecycle management in Azure Active Directory (Azure AD) multi-tenant environments. Reference the following articles in the series for more information.
18
+
This article is the first in a series of articles that provide guidance for configuring and providing user lifecycle management in Azure Active Directory (Azure AD) multi-tenant environments. The following articles in the series provide more information as described.
19
19
20
20
-[Multi-tenant user management scenarios](multi-tenant-user-management-scenarios.md) describes three scenarios for which you can use multi-tenant user management features: end user-initiated, scripted, and automated.
21
21
-[Common considerations for multi-tenant user management](multi-tenant-common-considerations.md) provides guidance for these considerations: cross-tenant synchronization, directory object, Azure AD Conditional Access, additional access control, and Office 365.
@@ -47,31 +47,35 @@ For the **UserType** property on users, B2B supports flipping the bit from inter
47
47
48
48
You can change an internal user from member user to guest user. For example, you can have an unlicensed internal guest user with guest-level permissions in the tenant, which is useful when you provide a user account and credentials to a person that isn't an employee of your organization.
49
49
50
-
You can change an external user from guest user to member user, giving member-level permissions to the external user. Making this change is useful when you manage multiple tenants for your organization and need to give member-level permissions to a user across all tenants. This need may occur regardless of whether the user is internal or external in any given tenant. Member users require more licenses (see [licensing considerations](../external-identities/external-identities-pricing.md)).
50
+
You can change an external user from guest user to member user, giving member-level permissions to the external user. Making this change is useful when you manage multiple tenants for your organization and need to give member-level permissions to a user across all tenants. This need may occur regardless of whether the user is internal or external in any given tenant. Member users may require more [licenses](../external-identities/external-identities-pricing.md).
51
51
52
52
Most documentation for B2B refers to an external user as a guest user. It conflates the **UserType** property in a way that assumes all guest users are external. When documentation calls out a guest user, it assumes that it's an external guest user. This article specifically and intentionally refers to external versus internal and member user versus guest user.
53
53
54
54
## Cross-tenant synchronization
55
55
56
-
[Cross-tenant synchronization](../multi-tenant-organizations/cross-tenant-synchronization-overview.md) enables multi-tenant organizations to provide seamless access and collaboration experiences to end users. Microsoft doesn't currently support cross-tenant synchronization across Microsoft sovereign clouds (such as Microsoft 365 US Government GCC High, DOD or Office 365 in China). See [Common considerations for multi-tenant user management](multi-tenant-common-considerations.md#cross-tenant-synchronization) for help with automated and custom cross-tenant synchronization scenarios.
56
+
[Cross-tenant synchronization](../multi-tenant-organizations/cross-tenant-synchronization-overview.md) enables multi-tenant organizations to provide seamless access and collaboration experiences to end users, leveraging existing B2B external collaboration capabilities. The feature doesn't allow cross-tenant synchronization across Microsoft sovereign clouds (such as Microsoft 365 US Government GCC High, DOD or Office 365 in China). See [Common considerations for multi-tenant user management](multi-tenant-common-considerations.md#cross-tenant-synchronization) for help with automated and custom cross-tenant synchronization scenarios.
57
57
58
-
Reference the following conceptual and how-to articles for information about Azure AD B2B collaboration and cross-tenant synchronization.
58
+
Watch John Savill talk about the cross-tenant sync capability in Azure AD (embedded below).
The following conceptual and how-to articles provide information about Azure AD B2B collaboration and cross-tenant synchronization.
59
63
60
64
### Conceptual articles
61
65
62
-
-[B2B best practices](../external-identities/b2b-fundamentals.md): Recommendations for providing the smoothest experience for users and administrators.
63
-
-[B2B and Office 365 external sharing](../external-identities/o365-external-user.md): Explains the similarities and differences among sharing resources through B2B, Office 365, and SharePoint/OneDrive.
64
-
-[Properties on an Azure AD B2B collaboration user](../external-identities/user-properties.md): Describes the properties and states of the external user object in Azure AD. The description provides details before and after invitation redemption.
65
-
-[B2B user tokens](../external-identities/user-token.md): Provides examples of the bearer tokens for B2B for an external user.
66
-
-[Conditional access for B2B](../external-identities/authentication-conditional-access.md): Describes how conditional access and MFA work for external users.
67
-
-[Cross-tenant access settings](../external-identities/cross-tenant-access-overview.md): Provides granular control over how external Azure AD organizations collaborate with you (inbound access) and how your users collaborate with external Azure AD organizations (outbound access).
68
-
-[Seamless application access and lifecycle management for multi-tenant Azure AD organizations](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/seamless-application-access-and-lifecycle-management-for-multi/ba-p/3728752): Enables a closely-related tenant that is part of a single multi-tenant organization to automatically synchronize users and map attributes to users in another closely-related tenant.
66
+
-[B2B best practices](../external-identities/b2b-fundamentals.md) features recommendations for providing the smoothest experience for users and administrators.
67
+
-[B2B and Office 365 external sharing](../external-identities/o365-external-user.md) explains the similarities and differences among sharing resources through B2B, Office 365, and SharePoint/OneDrive.
68
+
-[Properties on an Azure AD B2B collaboration user](../external-identities/user-properties.md) describes the properties and states of the external user object in Azure AD. The description provides details before and after invitation redemption.
69
+
-[B2B user tokens](../external-identities/user-token.md) provides examples of the bearer tokens for B2B for an external user.
70
+
-[Conditional access for B2B](../external-identities/authentication-conditional-access.md) describes how conditional access and MFA work for external users.
71
+
-[Cross-tenant access settings](../external-identities/cross-tenant-access-overview.md) provides granular control over how external Azure AD organizations collaborate with you (inbound access) and how your users collaborate with external Azure AD organizations (outbound access).
72
+
-[Cross-tenant synchronization overview](../multi-tenant-organizations/cross-tenant-synchronization-overview) explains how to automate creating, updating, and deleting Azure AD B2B collaboration users across tenants in an organization.
69
73
70
74
### How-to articles
71
75
72
-
-[Use PowerShell to bulk invite Azure AD B2B collaboration users](../external-identities/bulk-invite-powershell.md): Learn how to use PowerShell to send bulk invitations to external users.
73
-
-[Enforce multifactor authentication for B2B guest users](../external-identities/b2b-tutorial-require-mfa.md): Use conditional access and MFA policies to enforce tenant, app, or individual external user authentication levels.
74
-
-[Email one-time passcode authentication](../external-identities/one-time-passcode.md): The Email one-time passcode feature authenticates external users when they can't authenticate through other means like Azure AD, a Microsoft account (MSA), or Google Federation.
76
+
-[Use PowerShell to bulk invite Azure AD B2B collaboration users](../external-identities/bulk-invite-powershell.md) describes how to use PowerShell to send bulk invitations to external users.
77
+
-[Enforce multifactor authentication for B2B guest users](../external-identities/b2b-tutorial-require-mfa.md) explains how you can use conditional access and MFA policies to enforce tenant, app, or individual external user authentication levels.
78
+
-[Email one-time passcode authentication](../external-identities/one-time-passcode.md) describes how the Email one-time passcode feature authenticates external users when they can't authenticate through other means like Azure AD, a Microsoft account (MSA), or Google Federation.
75
79
76
80
## Terminology
77
81
@@ -102,10 +106,10 @@ Organizations initially focus on requirements that they want in place for immedi
102
106
### Communications requirements
103
107
104
108
-**Unified global address list:** Each user can see all other users in the GAL in their home tenant.
105
-
-**Free/busy information:** Enable users to discover each other's availability. You can do so with [Organization relationships in Exchange Online](https://learn.microsoft.com/exchange/sharing/organization-relationships/create-an-organization-relationship).
106
-
-**Chat and presence:** Enable users to determine others' presence and initiate instant messaging. Configure through [external access in Microsoft Teams](https://learn.microsoft.com/microsoftteams/trusted-organizations-external-meetings-chat).
109
+
-**Free/busy information:** Enable users to discover each other's availability. You can do so with [Organization relationships in Exchange Online](/exchange/sharing/organization-relationships/create-an-organization-relationship).
110
+
-**Chat and presence:** Enable users to determine others' presence and initiate instant messaging. Configure through [external access in Microsoft Teams](/microsoftteams/trusted-organizations-external-meetings-chat).
107
111
-**Book resources such as meeting rooms:** Enable users to book conference rooms or other resources across the organization. Cross-tenant conference room booking isn't currently available.
108
-
-**Single email domain:** Enable all users to send and receive mail from a single email domain (for example, `[email protected]`). Sending requires a third-party address rewrite solution.
112
+
-**Single email domain:** Enable all users to send and receive mail from a single email domain (for example, `[email protected]`). Sending requires an email address rewrite solution.
109
113
110
114
### Access requirements
111
115
@@ -128,4 +132,4 @@ Microsoft mechanisms for creating and managing the lifecycle of your external us
128
132
-[Multi-tenant user management scenarios](multi-tenant-user-management-scenarios.md) describes three scenarios for which you can use multi-tenant user management features: end user-initiated, scripted, and automated.
129
133
-[Common considerations for multi-tenant user management](multi-tenant-common-considerations.md) provides guidance for these considerations: cross-tenant synchronization, directory object, Azure AD Conditional Access, additional access control, and Office 365.
130
134
-[Common solutions for multi-tenant user management](multi-tenant-common-solutions.md) when single tenancy doesn't work for your scenario, this article provides guidance for these challenges: automatic user lifecycle management and resource allocation across tenants, sharing on-premises apps across tenants.
131
-
-[Multi-tenant synchronization from Active Directory](/hybrid/plan-connect-topologies) describes various on-premises and Azure Active Directory (Azure AD) topologies that use Azure AD Connect sync as the key integration solution.
135
+
-[Multi-tenant synchronization from Active Directory](../hybrid/plan-connect-topologies) describes various on-premises and Azure Active Directory (Azure AD) topologies that use Azure AD Connect sync as the key integration solution.
0 commit comments