MC1198077 – (Updated) Microsoft Entra: Cross-tenant security group synchronization

Product:

Entra

Platform:

Online, US Instances, Web, World tenant

Status:

In development

Change type:

Admin impact, New feature, Updated message, User impact

Links:

518221

Details:

Summary:
Microsoft Entra introduces cross-tenant security group synchronization, enabling centralized group management and resource sharing across tenants. Public Preview starts late January 2026; general availability begins late April 2026. Admins must opt in, update attribute mappings, and configure cross-tenant access policies to enable this feature.

Details:
Updated January 7, 2026: We have updated the content. Thank you for your patience.
We're introducing cross-tenant group synchronization, a new capability that enables organizations to synchronize security groups across Microsoft Entra tenants. This feature simplifies collaboration scenarios by allowing shared access to resources across tenants while maintaining centralized group management. It also streamlines administration of multiple tenants by centralizing group membership control, reducing duplication and manual overhead. The new group sync functionality will be part of the Microsoft Entra ID Governance / Microsoft Entra Suite license.
This message is associated with Microsoft 365 Roadmap ID 518221.
When this will happen
Public Preview: Rollout begins in late January 2026 and completes by late January 2026.
General Availability (Worldwide, GCC, GCC High, DoD): Rollout begins in late April 2026 and completes by late April 2026.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability, Preview

Created:
2025-12-18

updated:
2026-01-08

Public Preview Start Date

XXXXXXX ... free basic plan only

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

linked item details

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Cross-tenant group synchronization
If the change is implemented without proper preparation, it may lead to unauthorized access to resources across tenants due to misconfigured group synchronization settings, resulting in security vulnerabilities.
   - roles: IT Admin, Security Officer
   - references: https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-configure?pivots=same-cloud-synchronization" target="_blank" rel="nofollow noopener noreferrer">https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-configure?pivots=same-cloud-synchronization, https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=518221

Centralized group management
Without adequate preparation, the transition to centralized group management could disrupt existing workflows, leading to confusion among users regarding group memberships and access rights, negatively impacting user experience.
   - roles: IT Admin, End User
   - references: https://learn.microsoft.com/entra/id-governance/licensing-fundamentals#types-of-licenses, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-configure?pivots=same-cloud-synchronization" target="_blank" rel="nofollow noopener noreferrer">https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-configure?pivots=same-cloud-synchronization

Configutation Options**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

Microsoft Entra is introducing a new feature called cross-tenant security group synchronization. Think of it like having a master key that can open multiple doors in different buildings, but you only need to manage one key. This feature allows organizations to manage security groups across different Microsoft Entra tenants from a single place.

In practical terms, if your company operates in multiple regions or has different departments using separate Microsoft Entra tenants, this feature will let you manage access and resources centrally. It’s like having a single control panel for all your company’s locations, reducing the need to manually update each one separately. This not only saves time but also minimizes the chances of errors, much like having a universal remote for all your electronic devices instead of individual remotes for each.

The feature will be available for public preview in late January 2026, with general availability starting in late April 2026. Admins who want to use this feature will need to opt in and make some updates to attribute mappings and cross-tenant access policies. It’s similar to setting up a new universal remote where you need to configure it to work with all your devices.

For those managing Microsoft Entra tenants, it’s important to identify which groups need synchronization and work with other tenant admins to ensure everything aligns with your business processes. This is akin to coordinating with different departments to ensure everyone’s on the same page before rolling out a new company-wide policy.

No compliance issues have been identified with this feature, but it’s always a good idea to review it according to your organization’s standards. This new capability is part of the Microsoft Entra ID Governance or Microsoft Entra Suite license, ensuring that it fits within the existing framework of Microsoft 365 services.