I have a customer who wants to allow their business clients (multiple organizations each with their own AAD tenant) to log into their on-premises SharePoint environment.
I have seen Microsoft's documentation on integrating SharePoint with AAD and gone through the process detailed therein, but that only describes how to set SharePoint with one AAD tenant, not several.
I know that I can create a separate TrustedIdentityTokenIssuer for each AAD tenant and configure a web application to use several of them, meaning that a user trying to log in will be presented with a dropdown of identity providers to choose from. That dropdown is a little unfortunate, but I don't imagine there's any way around that.
The real problem comes in when it comes to person and group selection dialogs (e.g. for assigning permissions and so on). It seems that by default, SharePoint has no way of actually looking up users via identity providers so it just basically displays garbage (autocomplete with the entered text over and over):
To that end, the documentation linked above says to use a third party add-on, AzureCP, to resolve this issue. That works rather well for one AAD tenant, but AzureCP's documentation very plainly states that it can only be used with one TrustedIdentityTokenIssuer, not several.
So my question is: is there a good way to use SP on-prem with several AAD tenants? Is there a better way of going about this that doesn't involve multiple TrustedIdentityTokenIssuers? I know that SharePoint Online will allow someone from basically any AAD tenant to sign into SharePoint Online as long as the site has been shared with them and it basically has a single login box that works for people from any AAD tenant or O365 tenant. Is there away to set up something similar to that on SharePoint On-Premises?