4.3 Cross-Tenant Sync & External Identity Providers

Beyond one-off guest invites

Large enterprises often operate multiple Microsoft Entra tenants (by acquisition, geography, regulatory boundary, or historical IT). They also collaborate with partners whose identities live in non-Entra IdPs. SC-300 therefore tests two related skills:

1. Cross-tenant synchronization — automatically provision identities across related Entra tenants.
2. External identity providers — federate authentication with SAML or WS-Federation (and understand other External Identities auth options at a conceptual level).

Together with B2B collaboration and cross-tenant access settings, these tools complete the external identity toolkit for Domain 1.

Cross-tenant synchronization overview

Cross-tenant synchronization (CTS) is a Microsoft Entra capability that synchronizes users from a source tenant into a target tenant. Synchronized users in the target are typically represented for collaboration as B2B-style users so they can be assigned access locally, while identity lifecycle is driven from the source scope you configure.

Problems CTS solves

Multi-tenant organization context

A multi-tenant organization scenario involves several Entra tenants that represent one company (or a tightly coupled corporate group). Microsoft has been investing in multi-tenant organization experiences (for example improved collaboration UX across member tenants). Cross-tenant sync is a provisioning engine that supports those designs by making users from Tenant A available in Tenant B without relying solely on people clicking invite emails.

CTS is not the first choice for a short project with five vendor users from an unrelated company — use B2B invite + access packages. CTS shines when identity continuity across related tenants is ongoing and large-scale.

Cross-tenant sync building blocks

Conceptual components you should recognize:

Scope design

Never sync “all users” into a target tenant without a business reason. Prefer:

• Security groups that represent “needs access to Contoso target resources.”
• Attribute-based scoping when supported by your design process.
• Separate configurations per target if you have many tenants with different populations.

Over-scoping creates excess guest/sync objects, license questions, and governance noise in the target.

Attributes and identity continuity

Synced attributes support dynamic groups, CA filters, and admin readability in the target (department, display name, manager where mapped, etc.). Understand that source remains authoritative for those projected attributes; fixing a display name only in the target may be overwritten on the next cycle if the attribute is in scope — similar mental model to hybrid directory sync, but tenant-to-tenant rather than AD-to-Entra.

Lifecycle and deprovisioning

When a user leaves scope in the source (disabled, removed from scope group, deleted), CTS should update the target accordingly (block/delete soft-delete patterns depending on configuration and product behavior). Exam scenarios often reward “fix source scope / let sync deprovision” over “manually delete 4,000 guests one by one” for MTO offboarding.

CTS versus related features

Trap: choosing Entra Connect to solve “two cloud tenants in one company need shared user presence.” Connect addresses hybrid AD; cross-tenant sync addresses Entra-to-Entra multi-tenant provisioning.

Planning checklist for CTS (exam-oriented)

1. Confirm business ownership of source and target tenants and data boundary rules.
2. Ensure cross-tenant access organizational settings support the relationship.
3. Define scope groups and attribute mapping minimally.
4. Pilot a small set; validate sign-in, app assignment, and CA for synced users.
5. Define who assigns access in the target (groups, packages, apps) — sync alone does not equal authorization to sensitive apps.
6. Monitor provisioning logs for failures (hard deletes, scoping misses, permission issues).
7. Establish joiner-mover-leaver process that starts in the source system of record.

External identity providers (External Identities)

Not every collaborator authenticates with a Microsoft Entra workforce tenant. External identity providers integrate alternative authentication sources into your External Identities experience so users can sign in / redeem with those IdPs.

Why add an external IdP?

• A partner organization runs a SAML 2.0 or WS-Federation IdP (AD FS, another cloud IdP, custom federation suite).
• You want partner users to use their corporate credentials rather than Microsoft account sprawl or only email OTP.
• You are aligning federation for a strategic partner domain to a known IdP.

External Identities also includes options such as email one-time passcode and social identity providers where the product and tenant configuration allow — useful when partners lack a formal federation relationship. For SC-300, prioritize understanding SAML and WS-Fed federation admin tasks and when federation is the right design.

SAML and WS-Federation federation concepts

Both protocols establish a trust so the external IdP authenticates the user and issues a security token your Entra External Identities configuration accepts for that identity pathway.

Configuration elements you must respect

Regardless of protocol, federation breaks when any of these drift:

• Issuer / entity ID mismatches between IdP and Entra configuration.
• Reply URL / assertion consumer endpoint incorrect for the cloud environment.
• Signing certificate expired or rolled on IdP without updating the trust.
• NameID / email claims not matching how users are invited or matched.
• Domain association — partner users’ email domains must align with the configured IdP routing for those sign-ins.

Operational lifecycle of an external IdP

1. Gather partner metadata (or manual endpoints and certs).
2. Create the external IdP in Microsoft Entra External Identities.
3. Map claims required for unique user identification (typically email/UPN-style identifiers).
4. Assign domains or otherwise ensure users with those domains hit this IdP path.
5. Test with a pilot partner account: redeem invite, complete auth, land on assigned app.
6. Monitor sign-in failures; coordinate certificate rollover windows with the partner.
7. Decommission cleanly when the partner relationship ends (do not leave stale trusts).

Choosing the right external identity approach

Security and governance considerations

• Federation is trust: a compromised partner IdP can assert identities for domains you accept — limit domains, monitor sign-ins, require CA MFA where appropriate, and review partner security posture.
• CTS multiplies presence: users appear in multiple tenants; access reviews and least privilege must run in each tenant that holds access.
• Attribute leakage: only map attributes the target needs; avoid syncing sensitive HR fields without purpose.
• Admin roles: configuring external IdPs and cross-tenant sync requires privileged identity admin roles — use PIM and change control.
• Logging: use Entra sign-in logs (including failed federated attempts) and provisioning logs for CTS troubleshooting.

Exam traps

• Using cross-tenant sync for a one-week external agency project (overkill; invite/package instead).
• Choosing Entra Connect to link two cloud-only Entra tenants.
• Forgetting that CTS provisions identity presence, not automatic access to every app — assignment still required.
• Ignoring certificate expiry on SAML/WS-Fed trusts.
• Confusing WS-Fed/SAML external IdP (partner auth into External Identities) with app registration SSO for a SaaS app you publish (related skills, different admin blades and purposes).
• Enabling broad social IdPs in a high-security tenant without policy alignment.

Putting the chapter together

External identity mastery for SC-300 is a stack:

1. Guest lifecycle & collaboration settings — invite, redeem, restrict, offboard.
2. Cross-tenant access settings — default vs organizational, inbound/outbound, direct connect, trust claims.
3. CTS & external IdPs — scale related-tenant provisioning and federate non-Entra authenticators.

/practice/azure-sc-300Practice questions with detailed explanations