Entra ID Multi-Tenant Organizations
MTO is Microsoft's modern model for running multiple Microsoft 365 tenants as one organisation. Here's what it provides.
Organisations end up with multiple Microsoft 365 tenants for many reasons — acquisitions, regulatory separation, subsidiary autonomy. Historically, running multiple tenants meant lots of cross-tenant friction. Microsoft Entra ID Multi-Tenant Organizations (MTO) is the modern feature designed to make that less painful.
What MTO provides
When two or more tenants are joined as an MTO:
- Cross-tenant user synchronisation: users from one tenant are auto-provisioned as B2B guests in the other tenants, with attribute sync.
- Cross-tenant access policies are streamlined — the trust between MTO members is configured once.
- Unified people search across MTO tenants, so users from one tenant appear in the address book of another.
- Shared channels in Teams work cleanly between MTO members.
- Cross-tenant search in Microsoft Search — find content across all member tenants.
- Microsoft 365 Copilot can ground answers across tenants the user is a member of.
The user experience is closer to "one big company" while preserving tenant-level boundaries.
What MTO doesn't do
MTO is not a merger of tenants:
- Each tenant keeps its own licences, billing, Conditional Access, retention policies, and admin roles.
- Email addresses, SharePoint sites, and mailboxes remain per tenant.
- It doesn't replace a true tenant-to-tenant migration if you want one logical Microsoft 365 instance.
When MTO is the right choice
- Holding companies running multiple subsidiaries with separate compliance requirements.
- Recent acquisitions where a full migration is months or years away.
- Regulated industries where some business units must stay separate but still need to collaborate.
- Joint ventures where two organisations need to share a working surface without sharing identity.
Configuration
MTO is configured via Entra admin center under External Identities → Multi-Tenant Organization:
- The "primary" tenant creates an MTO and invites others.
- Each tenant joins by accepting the invite.
- Cross-tenant access settings are configured for inbound/outbound trust.
- Cross-tenant synchronization jobs are set up to auto-provision users between tenants.
Each tenant can leave the MTO at any time.
Limits
MTO supports up to a few hundred tenants in a single MTO as of 2026, with practical recommendations to keep it smaller. It's designed for organisations that operate as a federation, not as a public marketplace.
When to migrate instead
If two tenants are essentially one organisation that happens to have two tenants for historical reasons, a tenant-to-tenant migration is usually a better long-term answer than MTO. Tools from Microsoft (Mover, the M365 Migration Manager) and partners (Quest, BitTitan, AvePoint) automate the move. MTO is right when the separation needs to stay.