Search code examples
azure-active-directorymulti-tenant

How to make 2 AD tenants authenticate between each other?

I am a service provider which develops PBI reports to multiple clients. I manage the PBI account and tenants for my clients. For each client I create a new tenant which I manage for them. In this tenants I keep all the PBI fils (PBIX), reports and datasets. If my client already has a 365 account (for his email, teams etc) I create a new tenant in addition to the one he uses.

For example: the client private tenant is @ABCcompany.com. in this tenant, the client has his email account, teams, Office 365 etc. I create a tenant @BIABCcompany. This tenant stores the PBI account.

In the current situation, shen the client wants to use the BI reports , he need to log out of his private 365 tenant (@ABCcompany.com) and log in to (BIABCcompany.com).

My final goals are:

  • I want to remove this sign in and sign out step, but I don’t want to store the PBI files (PBIX) files on the client tenants.
  • I want that my client will be able to consume the PBI reports on Microsoft teams while he signing to his tenants (@ABCcompany.com)

As I imagine this, I need to make both tenants to talk to teach other and be able to aunticate between one to each other? I this possible?

What I need to do? I read about guests accounts, share domain and many other Azure AD feature but I don;t sure which one of them I should use.

Thank you, Tal

Solution

  • You can make use of Azure AD B2B collaboration to achieve your scenario.

    Azure AD B2B collaboration enables users to use one set of credentials to sign in to multiple tenants.

    Using the above method, the user with @ABCcompany.com can be invited as a guest user to another tenant (@BIABCcompany.com) and he can sign in using his home tenant credentials(@ABCcompany.com).

    You can create the guest users by referring this blog of Hadshana Kamalanathan like below:

    Go to Azure Portal -> Azure Active Directory -> Users -> New user

    enter image description here

    To make the guest users to access the resources in another tenant, make sure to modify the settings like below:

    Go to Azure Portal -> Azure Active Directory -> External Identities -> External collaboration settings

    enter image description here

    References:

    Multi-tenant architecture for large institutions - M365 Education | Microsoft Docs

    Enable B2B external collaboration settings - Azure AD - Microsoft Entra | Microsoft Docs