2

We have ADFS synchronised via Azure portal AD to an existing O365 tenancy for authentication. A new requirement means we need a test tenancy separate from our existing tenancy.

We have only one Active Directory On-Premises.

Is it possible to have two separate tenancies for O365 synced with on-premises AD for authentication? If so are there links or documentation from Microsoft for this configuration? (i.e. we would use existing AD Accounts to authenticate with two tenancies).

Or suggest correct way we should approach this problem?

2 Answers 2

1

Microsoft has an excellent description about the supported Topologies:

https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-topologies#multiple-azure-ad-tenants

For your situation, i see the following:

  • One domain can only be registered to one Office365 Tenant. So you need a separate domain for your Test-Tenant which is registered there
  • Add the new domain as UPN-Suffix to your ActiveDirectory
  • Create an OU in your local AD. Create Test-Accounts there. Give them an UPN with your newly registered Suffix
  • Create a second AAD-Sync Connection to your test-tenant and sync only the "Test-OU". Remove the Test-OU from your productive AAD-Sync.
1

We have the same challenge with customer projects. Typically we run staging tenants with no AD sync. Instead we import users and AD groups with PowerShell scripts to the staging tenants maintaining the user name (the part before the @) so we can test permissions. The UPNs for staging users are not the same as production users. Custom Code we develop that depends on UPNs takes this into account.

It is not fantastic solution but it works well for us. As long as you can only sync a given user to one tenant I do not see any other options.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.