Search code examples
azureazure-active-directory

What happens to Azure AD guest account in the guest tenant when the account in home tenant gets deleted?

I have one windows server with its AD synced to Azure AD with AD connect, the users are using O365. Some accounts in this tenant are then invited to another tenant as guest accounts.

  1. What happens, when I delete the account from AD? Does it gets disabled in AAD (stil in the "home" tenant") or do I have remove from AAD manually?
  2. And what happens to the guest account in the other tenant? I'd like to think, that if the primary AAD accounts gets deleted, then the guest account in another tenant also gets deleted automatically.

Many thanks for any pointers

Solution

  • When you delete an on-premises AD account that is synced to Azure AD (AAD) via Azure AD Connect:

    1. The corresponding account in Azure AD will also be deleted (soft delete) during the next synchronization cycle. It doesn't get disabled; it gets removed. This doesn't mean the account gets deleted immediately from AAD. It goes into a "soft delete" state, where you have a 30-day period during which you can restore the user account. After this 30-day period, it is permanently deleted.

    2. The guest account in another Azure AD tenant doesn't get deleted automatically when the original Azure AD account gets deleted. The guest account's status in the external directory might be set to "External - User account disabled" if the original account is no longer accessible. However, the account itself will remain until manually removed by an administrator in that tenant.

    Guest accounts (B2B) are essentially references or pointers back to the original Azure AD account, and while certain aspects of their state may be linked to the original account, their lifecycle isn't tightly coupled. That is, deleting the original account won't auto-delete the guest account.