I have a customer who wants to allow their business clients (multiple organizations each with their own AAD tenant) to log into their on-premises SharePoint environment.

I have seen Microsoft's documentation on integrating SharePoint with AAD and gone through the process detailed therein, but that only describes how to set SharePoint with one AAD tenant, not several.

I know that I can create a separate TrustedIdentityTokenIssuer for each AAD tenant and configure a web application to use several of them, meaning that a user trying to log in will be presented with a dropdown of identity providers to choose from. That dropdown is a little unfortunate, but I don't imagine there's any way around that.

The real problem comes in when it comes to person and group selection dialogs (e.g. for assigning permissions and so on). It seems that by default, SharePoint has no way of actually looking up users via identity providers so it just basically displays garbage (autocomplete with the entered text over and over):

enter image description here

To that end, the documentation linked above says to use a third party add-on, AzureCP, to resolve this issue. That works rather well for one AAD tenant, but AzureCP's documentation very plainly states that it can only be used with one TrustedIdentityTokenIssuer, not several.

So my question is: is there a good way to use SP on-prem with several AAD tenants? Is there a better way of going about this that doesn't involve multiple TrustedIdentityTokenIssuers? I know that SharePoint Online will allow someone from basically any AAD tenant to sign into SharePoint Online as long as the site has been shared with them and it basically has a single login box that works for people from any AAD tenant or O365 tenant. Is there away to set up something similar to that on SharePoint On-Premises?


I'm not sure if this is a possibility for you, but you could connect to one AAD, and setup AzureCP for that AAD. Then add the users from the other AADs as B2B users in the AAD that you connected to SharePoint. It is not the best solution as new users in the "Other" AADs would have to be constantly added as B2B users.

  • That might actually work since potentially my customer could use their AAD as the main AAD and invite their clients as B2B users. I will look into this since I don't know anything about B2B at this point and get back to you. Thank you for the answer! – JLRishe Jan 14 '20 at 3:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.