Microsoft 365 Multitenant Organization (MTO) Setup Guide: Cross-Tenant Sync, Teams Collaboration & Exchange Address Book

When an organization operates multiple Microsoft 365 tenants, getting users to work together can be more difficult than expected.

Consider a company with separate Microsoft 365 tenants for its headquarters and regional offices. Employees belong to the same business, but their accounts, Exchange mailboxes, Teams configurations and address books are maintained separately.

A user in one tenant might know a colleague's email address but still struggle to find that person in the Outlook address book. Teams communication might work through external access, but the experience isn't quite the same as communicating with someone in the same organization.

This is where Microsoft 365 Multitenant Organization (MTO) becomes useful.

MTO allows an organization to establish a relationship between its Microsoft Entra tenants and improve how users discover and collaborate with colleagues across those tenants.

In this Blog, I'll cover how to configure an MTO, synchronize users between tenants, enable Teams communication, make users discoverable in the Exchange address book, configure calendar availability and verify the configuration.

I'll also cover the limitations and a few settings that deserve attention before rolling this out in production.

Understanding how MTO works

An MTO is a logical grouping of Microsoft Entra tenants belonging to the same organization.
It does not merge tenants or move user accounts, Exchange mailboxes, SharePoint sites or Teams data between them.
Each tenant continues to maintain its own identities, licensing, security policies and Microsoft 365 workloads.

MTO works alongside several existing capabilities:

• Microsoft Entra cross-tenant synchronization: Provisions users from one tenant into another as B2B collaboration identities.
• Cross-tenant access settings: Controls how users authenticate and access resources in participating tenants.
• Microsoft Teams external access: Enables chat, calls and meetings across tenants.
• Microsoft 365 people search: Makes synchronized users discoverable across supported Microsoft 365 applications.
• Exchange Online organization relationships: Allows users in different tenants to view calendar availability when configured.

For the improved MTO experience in Teams, synchronized users should be provisioned as B2B collaboration users with UserType = Member.

Note: MTO does not create a single central Exchange directory. Instead, it allows participating tenants to maintain synchronized representations of users so they can be discovered in the applications they use.

Prerequisites

Before creating the MTO, check the following.

Requirement	What to verify
Tenants	At least two Microsoft Entra tenants under the organization's control
Licensing	Microsoft Entra ID P1 or above
Administrator access	Global Administrator access for initial MTO creation and joining
Teams	Supported Teams clients and appropriate external access policies
Exchange	Exchange Online configuration for address-book and calendar tests
Cross-tenant policies	Existing B2B collaboration, Conditional Access and external access restrictions
Existing identities	Guest accounts or mail contacts already created for users in the other tenant

For cross-tenant user synchronization, each synchronized user needs the appropriate Microsoft Entra ID P1 entitlement in the home/source tenant. A duplicate user license isn't required in the destination exclusively for synchronization, though other resource-tenant services may have licensing requirements.

For a production deployment, start with a few test users instead of synchronizing everyone immediately.

I would also review existing guest accounts and Exchange mail contacts before enabling synchronization. These objects can result in duplicate search entries or unexpected user experiences later.

Create the Multitenant Organization

I will begin in First Tenant , which will become the owner. This we can decide based on our Business needs.

Step 1: Open Multitenant collaboration

Sign in to https://admin.microsoft.com using a Global Administrator account in Owner Tenant.
Expand Settings.

Select Org settings. Open the Organization profile tab. Select Multitenant collaboration.

Click Get started.

Step 2: Create a new organization

Select Create a new multitenant organization.
Click Next.

Enter the MTO name and description.

For this example:

Name: MTO-Org-1

Description: Multitenant collaboration between HQ and regional Microsoft 365 tenants.

Next, enter the Microsoft Entra tenant ID of  Member Tenant.

You can find the tenant ID from Microsoft Entra admin center → Entra ID → Overview.

Step 3: Configure the initial trust options

During creation, you'll be presented with two important options:

• Allow users to sync into this tenant from the other tenants in this multitenant organization.
• Suppress consent prompts for users from the other tenant when they access apps and resources in my tenant.

Select these options after confirming that the participating tenants are approved for this trust relationship.

The first option allows inbound cross-tenant synchronization.

The second enables automatic invitation redemption, helping users avoid repeated consent prompts when accessing resources through supported B2B experiences.

Click Next, review the configuration and select Create multitenant organization.

Once the MTO is created, copy the joining instructions for the administrator of  Member Tenant.

At this point, Tenant which we crated the MTO setup  is the MTO owner, but Second Tenant still needs to join.

Join the second tenant to the MTO

Now sign in to the Microsoft 365 admin center for Second Tenant.

Navigate to:

Settings → Org settings → Organization profile → Multitenant collaboration

Click Get started.
Select Join an existing multitenant organization.

Enter the tenant ID of  Owner Tenant. You can get the details from Owner Tenant MTO page.

Enable the inbound synchronization and consent suppression options as appropriate.

Click Join Multitenant organization.

and then Done.

Return to the Multitenant collaboration page and check the membership status.

Joining can take some hours, so don't assume the configuration failed if the status doesn't update immediately.

The expected result is that both tenants become active.

Below screenshot shows MTO status from Owner Tenant

Below screenshot shows MTO status from Member Tenant.

What happens behind the scenes?

When the tenant joins, the MTO setup creates or configures supporting Microsoft Entra relationships.
These include:

• Cross-tenant access relationships.
• Inbound synchronization permissions.
• Automatic invitation redemption settings.
• Cross-tenant synchronization configurations named MTO_Sync_<TenantID>.

However, the existence of a synchronization configuration does not mean user provisioning is already running.
We still need to select which users will be shared.

Verify cross-tenant access settings in Microsoft Entra

Before synchronizing users, I recommend checking the relationships created in both tenants.

Open https://entra.microsoft.com.

Navigate to:

Entra ID → External Identities → Cross-tenant access settings → Organizational settings

You should find the participating tenant listed.

Open the relationship and review:

Inbound access settings

Check the B2B collaboration settings, application restrictions and trust configuration. Confirm that cross-tenant synchronization is allowed.

In my case its following the Default Settings ,If required we can customize it.

Outbound access settings

Verify that the users who need to collaborate are permitted to access the other tenant.

Automatic redemption

Confirm that the invitation redemption settings reflect the trust agreed between administrators.

Cross-Tenant Sync

Confirm that the Allow user Synchronization into this tenant is checked.

Enabling this will allow the admin of the specified (source) tenant to sync objects into this (target) tenant.

Note: Cross-tenant synchronization for groups requires Microsoft Entra ID Governance or Microsoft Entra Suite licenses on Source Tenant.

Don't overlook Conditional Access

An MTO relationship doesn't automatically bypass Conditional Access policies.

For example, if  Memeber Tenant  requires a compliant device for access to its applications, users from Owner Tenant  may still be blocked unless their device satisfies the policy or an appropriate cross-tenant trust configuration is in place.

Before enabling trust of MFA or compliant-device claims from another tenant, verify that the partner tenant's security controls are acceptable.

Avoid excluding all synchronized users from Conditional Access simply to make cross-tenant collaboration work.

Configure user synchronization

Now that both tenants are active MTO members, we can start synchronizing users.

Sign in to the Microsoft 365 admin center for Owner Tenant.

Navigate to: Settings → Org settings → Multitenant collaboration

Select Share users.

Click Select users for simplified sync and select the pilot users who should be available in the other tenant.

For this example, select Alex Thomas.

A small pop-up will appear, reminding you to review the External Access settings in the Microsoft Teams Admin Center.

For seamless cross-tenant Teams communication, ensure that External Access is enabled in your tenant and the other participating tenants within your organization. If any external access restrictions are configured, review and adjust them as necessary to allow communication between the tenants.

Note: Some of the users you have selected to share may exist as guest users in other tenants. For a better collaboration experience, Its always recommend to convert guest users to members after they have been shared

Save and confirm the selection.

After some time, the Outbound Sync status will change to Enabled. You can then click on the member tenant to review the synchronization configuration and view the synced users.

Repeat the same process in Member Tenant and select the User which we need to sync to other Tenant(Owner or other Member Tenant).

This is important because cross-tenant synchronization is directional.

From Member Tenant I have shared 3 users to Owner Tenant.

Microsoft 365 admin center or Microsoft Entra synchronization?

There are two ways to manage synchronization.

Option 1: Microsoft 365 admin center

Use this when the same selected users should be shared with all participating MTO tenants. This is usually the simpler approach for a small environment.

Option 2: Microsoft Entra cross-tenant synchronization

Use this when you need more control over which users are synchronized to which tenants, attribute mappings, group-based assignments or provisioning scope.

If you need different user populations for different tenants, I would choose the Entra synchronization configuration rather than relying on the simplified Microsoft 365 experience.

Also, don't rename or casually modify the MTO_Sync_<TenantID> configurations created and managed by the Microsoft 365 admin center. Doing so can interfere with its ability to recognize and manage the jobs.

Once the Multi-Tenant Organization (MTO) setup is completed, a Cross-Tenant Synchronization connection is automatically created. However, the connection will not be fully configured or enabled until you initiate user sharing through the MTO configuration or manually configure and activate the synchronization connection from the Microsoft Entra Admin Center.

Once users are shared through the MTO configuration, Cross-Tenant Synchronization will be activated, as shown in the screenshot below.

Once you select the Cross-Tenant Synchronization configuration, you can view the details of the MTO synchronization connection. From this configuration, you can also manage attribute mappings, scoping filters, and assigned users and groups. Additionally, you can monitor synchronization activities and troubleshoot issues by reviewing the Audit Logs and Provisioning Logs associated with the connection.

Verify synchronized users in the destination tenant

After synchronization starts, open the Microsoft Entra admin center for Member Tenant.

Navigate to: Entra ID → Users → All users

Search for Alex.

A synchronized account should appear as an external identity representing Alex's home account.

Check and verify the account properties.

If a user hasn't appeared, check the provisioning logs before changing unrelated settings.

Remember that successful directory provisioning and visibility in Microsoft 365 applications\ Entra ID aren't necessarily immediate(Normal Sync cycle is every 40min). Allow time for the recipient and search information to become available.

Configure Microsoft Teams communication between tenants

This is one of the main reasons for enabling MTO.

Users should be able to find colleagues in other participating tenants and initiate Teams communication without treating every interaction as a separate guest collaboration scenario.

However, creating an MTO and synchronizing users isn't sufficient if Teams external access policies prevent communication.

Step 1: Review the MTO Teams collaboration setting

From the Microsoft 365 admin center:

Settings → Org settings → Multitenant collaboration → Manage settings

Under Teams collaboration, select Edit.

Use the option to open the configuration in the Microsoft Teams admin center.

This must be configured appropriately in both participating tenants.

Step 2: Configure external access in Teams

Open https://admin.teams.microsoft.com.

Navigate to: Users → External access

Review the settings for communication with trusted Microsoft 365 organizations.

If your organization uses an allowed-domains list, make sure the participating tenant's domain is included.

Review any other domains that users legitimately use for Teams communication.

Step 3: Check external access policies

Teams supports both organization-wide settings and user-level external access policies.

A tenant-wide configuration might allow communication, while an assigned user policy can still prevent it.

Review the policies assigned to the pilot users.

Step 4: Test Teams communication

Open the current Teams desktop client as Alex.

Search for: Adele or John

After the user becomes discoverable, check the following:

1. Adele appears in the search results.
2. Alex can open Adele profile card.
3. Alex can initiate a chat.
4. Adele receives the message in Teams.
5. Presence information is displayed when available.
6. Both users can participate in a Teams meeting.

A few points about the Teams experience

For the most complete MTO experience, use the current Teams desktop client. Supported mobile and VDI clients also provide MTO capabilities, while Teams on the web can offer a more limited experience.

MTO doesn't automatically grant membership to every Team or channel in another tenant.

Users may still need to be added to the relevant Teams resources.

For Teams shared channels, make sure the cross-tenant B2B direct connect settings and Teams shared-channel policies are configured separately.

One more testing is existing Teams chat history. If a user previously collaborated as a guest and is later converted to a B2B member, old chat conversations aren't merged into the new MTO experience. Some older guest chat threads may no longer support sending new messages.

Check the synchronized user in Exchange Online

Open the Exchange admin center in any of the Tenant(in My case i open Member Tenant) :

https://admin.exchange.microsoft.com

Navigate to:

Recipients → Contacts

Check whether Alex & Ajay appears as a mail-enabled user associated with their home email address.

Depending on the synchronization and recipient provisioning state, User should be represented as an Exchange mail user.

Test the Outlook address book

Sign in to Outlook on the web using Alex's account:

https://outlook.office.com

Create a new email. In the To field, start typing: Adele

Check whether Outlook resolves her as a recipient and displays her home email address.

Next, open the recipient's profile card and check the available contact information.

Configure cross-tenant calendar availability

Being able to find another user in Outlook is useful, but users often want to check a colleague's availability before sending a meeting invitation.

MTO provides a way to configure calendar availability sharing through Exchange Online organization relationships.

Microsoft 365 admin center → Settings → Org settings → Multitenant collaboration → Manage settings

Under the calendar settings, select Edit calendar settings. Save the changes. Repeat the configuration on Both Tenants

The calendar-sharing feature exposes free/busy time information rather than automatically granting detailed access to another user's private calendar.

A few additional MTO settings worth reviewing

After the basic collaboration experience works, there are a few more settings worth considering.

Tenant labels in Microsoft Teams

When users belong to several MTO tenants, it may not be knowoing which company or region a colleague belongs to.

MTO allows the owner to configure tenant labels that appear alongside synchronized users in supported Teams experiences.

To configure Open: Multitenant collaboration → Manage settings → Tenant label → Edit

Choose whether to show no label, the MTO name or a custom label for each participating tenant.
For example:

• HQ
• Bahrain
• UAE
• Saudi Arabia

This can be particularly useful for organizations with several regional subsidiaries.

Outlook external tagging

Some organizations configure Outlook to display an external sender warning for messages received from outside their tenant.

MTO has an option to suppress that external indicator for participating MTO tenants.

The setting is available under: Multitenant collaboration → Manage settings → External tag

I would evaluate this carefully before enabling it.

Even when the tenants belong to the same organization, the messages still cross tenant boundaries. Removing the external indicator changes what users see and can reduce a useful warning.

The configuration can also affect Exchange remote-domain settings, including the internal classification of a remote domain. For security-conscious environments, leaving the external indicator enabled may be preferable.

MTO activity and notifications

The Multitenant collaboration interface also includes activity information and optional email notifications.

Administrators can use these to keep track of events such as tenant membership changes, MTO setting changes and supported synchronization status updates.

New Attributes Supported in MTO Cross-Tenant Sync

Microsoft 365 admins can now extend the MTO cross-tenant synchronization schema from the Microsoft 365 admin center to support additional Exchange attributes.

Newly supported attributes:

• MSExchRecipientDisplayType & MSExchRecipientTypeDetails: Help identify synchronized meeting rooms correctly in the target tenant's Global Address List (GAL).
• userSMIMECertificate & userCertificate: Support S/MIME certificates for signed and encrypted emails across tenants.

Important: Existing values won't sync automatically after enabling these mappings. Previously synchronized users must be re-synchronized, and only new or updated attribute values will sync.

How to Update the MTO Sync Schema

Go to Microsoft 365 admin center → Settings → Org settings → Organization profile → Multitenant collaboration.
Click the Schema update is recommended to unlock new capabilities notification.

Review the newly supported attributes and select Update schema.

The new attributes will be picked up during the next cross-tenant sync cycle, and the notification will disappear automatically once the schema is updated.

Once update is completed we can see this in Cross-tenant syn under attributes mapping tab

Limitations and considerations before production rollout

1. MTO isn't tenant consolidation

Every tenant remains independent.
MTO doesn't merge licenses, Exchange mailboxes, accepted domains, SharePoint sites, Teams or security configurations.
An MTO should not be positioned as a replacement for tenant-to-tenant migration.

2. Existing guest users can behave differently

If a user already exists as a B2B guest, synchronization doesn't necessarily convert the account to Member automatically.
Review the user-type attribute mapping before starting a large deployment.
Converting existing guests can also affect Teams conversations and Exchange recipient behavior.

3. Directory provisioning doesn't guarantee immediate application visibility

A synchronized user may appear in Entra ID before the user becomes searchable in Teams or Outlook. Plan for propagation and indexing delays.

4. External access must be allowed in both tenants

An allowed domain in One Tenant is not sufficient if other Tenant blocks communication.
Also consider user-level Teams external access policies.

5. MTO changes how some internal sharing experiences work

Synchronized B2B Member users can qualify for certain People in your organization sharing experiences in SharePoint and OneDrive.
This can expand the population covered by organization-scoped sharing links.
Review existing sharing settings and sensitive-content controls before synchronizing a large user population.

6. Not every Microsoft 365 application has the same experience

Teams and Outlook are among the main collaboration workloads benefiting from MTO.
Other Microsoft 365 and Microsoft cloud applications can retain their existing B2B limitations. MTO doesn't provide a universal shared identity or automatically grant access across every workload.

7. Tenant and cloud limits still apply

The standard self-service MTO experience supports up to 100 tenants.Participating tenants need to meet the supported cloud requirements.

8. MTO doesn't synchronize every type of object

User synchronization isn't the same as synchronizing complete directories.Devices, mail contacts, all groups and application configurations aren't automatically replicated as part of the basic MTO setup.

9. Leaving an MTO doesn't clean up everything automatically

Removing a tenant from an MTO doesn't automatically remove its existing cross-tenant synchronization jobs or cross-tenant access settings. Administrators need a separate offboarding plan to remove unwanted access and synchronized identities.

Security checks I would complete before wider deployment

Before extending MTO to a large user population, review:

• Whether participating tenants belong to the same trusted organization.
• Which users should be synchronized and which should remain excluded.
• The effect of B2B Member identities on SharePoint and OneDrive sharing.
• Conditional Access coverage for synchronized users.
• Whether external MFA or compliant-device claims should be trusted.
• Existing access packages, group assignments and application permissions.
• How user removal and account deprovisioning will work.
• Whether Outlook external warning suppression is appropriate.
• Who will monitor the synchronization jobs and membership changes.

I would also avoid synchronizing privileged administrative accounts unless there is a specific, reviewed requirement.

Conclusion

Microsoft 365 Multitenant Organization (MTO) makes collaboration across multiple tenants easier without requiring tenant consolidation. With cross-tenant synchronization, Teams collaboration, and Exchange address book integration, users can discover and communicate with colleagues across tenants more seamlessly.

The key is to validate synchronization, Teams policies, address book visibility, and security settings before rolling out to production. A small pilot is always a better option.