Latest / The Identity Blueprint / Day One of the M&A. How Does Integration Start on Microsoft Entra?

Transcript

Day One of the M&A. How Does Integration Start on Microsoft Entra? · The Identity Blueprint

• 0:00
  SPEAKER_00: Welcome back to the identity blueprint beyond the domain.
• 0:03
  SPEAKER_00: I'm Ernie with Jose.
• 0:05
  SPEAKER_00: We've spent the last two episodes on steady state architecture, migrating off AD when nobody's forcing your hand.
• 0:12
  SPEAKER_00: Today the clock is running, an acquisition just closed, and your newly acquired workforce needs working logins on Microsoft Intra before anyone notices the outage.
• 0:22
  SPEAKER_00: We trace the actual math, the object GUID join keys that stopped two John Smiths from colliding, the July 2026 security hardening that shut down a nasty hard match hijack, and why cross-tenant sync beats B2B guest invites when you're onboarding an entire acquired company at once.
• 0:42
  SPEAKER_00: If you're the architect everyone turns to when day one goes sideways, this is your diagnostic manual.
• 0:49
  SPEAKER_00: Let's get into it.
• 0:50
  SPEAKER_00: So, I mean, imagine you just spent uh five billion dollars to acquire a major competitor.
• 0:55
  SPEAKER_00: Like the ink on the contract is totally dry.
• 0:57
  SPEAKER_00: Right.
• 0:57
  SPEAKER_00: The CEO is on CNBC, you know, cheering about synergies, the press releases are out, and it's officially day one.
• 1:04
  SPEAKER_01: The big day.
• 1:05
  SPEAKER_00: Exactly.
• 1:06
  SPEAKER_00: So 5,000 newly acquired employees, they sit down at their desks, they open their laptops, and they get a blank screen.
• 1:14
  SPEAKER_00: They can't check their email, they can't access the HR portal to enroll in benefits, they uh they can't even message their new managers.
• 1:22
  SPEAKER_00: Trevor Burrus, Jr.
• 1:23
  SPEAKER_01: Total blackout.
• 1:24
  SPEAKER_00: Right.
• 1:25
  SPEAKER_00: The legal entity might be unified on paper, but your digital nervous system is just completely fractured.
• 1:30
  SPEAKER_00: Yeah.
• 1:30
  SPEAKER_00: And suddenly you you know the IT architect sitting in the war room, you are the only person who can stop this multi-billion dollar merger from just grinding to an absolute halt.
• 1:40
  SPEAKER_01: Aaron Powell It really is uh the ultimate pressure test for an identity architect because I mean when a merger fails on day one, it it rarely fails in the boardroom, right?
• 1:49
  SPEAKER_01: It fails in the Active Directory logs, it uh fails in the routing tables.
• 1:54
  SPEAKER_01: The biological reality of merging two distinct corporate entities is, well, it's entirely dependent on the underlying identity math.
• 2:01
  SPEAKER_00: Aaron Ross Powell Exactly.
• 2:02
  SPEAKER_00: And you know, that is exactly why we are bypassing the high-level management theory today.
• 2:07
  SPEAKER_00: We are looking directly at the diagnostic x-rays of corporate mergers and acquisitions.
• 2:11
  SPEAKER_00: Aaron Powell Getting into the weeds.
• 2:13
  SPEAKER_00: Yeah, we really are.
• 2:14
  SPEAKER_00: Because like when a company is bought, how do the IT systems actually, you know, mechanically merge?
• 2:20
  SPEAKER_00: How does an employee at the acquired company log in on day one without wanting to just throw their laptop out a window?
• 2:27
  SPEAKER_01: Aaron Powell To answer that, we are uh we're going deep into the head and plumbing.
• 2:30
  SPEAKER_01: I mean, we've pulled together a massive stack of technical documentation, architectural reviews, comparative analyses of identity platforms like you know, Okta, Ping Identity, and CyberArcr.
• 2:40
  SPEAKER_00: Aaron Powell, Jr.
• 2:40
  SPEAKER_00: Which are huge in this space.
• 2:41
  SPEAKER_01: Aaron Powell Huge.
• 2:42
  SPEAKER_01: And crucially, we've got the recent Microsoft Entra release notes from 2025 and uh 2026.
• 2:48
  SPEAKER_01: We are focusing specifically on integrating an acquired organization's identities into a parent company's Microsoft UNTRA ID environment.
• 2:56
  SPEAKER_00: Okay, let's unpack this.
• 2:56
  SPEAKER_00: And just so you know, we are not just gonna read you the manual or tell you like what buttons to click in the admin center.
• 3:03
  SPEAKER_00: We are going to break down the exact API calls, the synchronization limits, and uh the edge cases that will absolutely take down your network if you aren't into getting them.
• 3:14
  SPEAKER_00: We actually have three distinct architectural scenarios we are gonna tear down today.
• 3:18
  SPEAKER_01: Aaron Powell Right.
• 3:19
  SPEAKER_01: And we should probably start with the most common, yet historically, you know, the most painful scenario, which is acquiring a legacy on-premises only organization.
• 3:29
  SPEAKER_00: Aaron Powell Oh man.
• 3:30
  SPEAKER_00: Okay, let's set the board for this one.
• 3:32
  SPEAKER_00: So you are the lead architect for the parent company.
• 3:35
  SPEAKER_00: You have a beautiful modern ultra-ID cloud environment.
• 3:39
  SPEAKER_01: Trevor Burrus, Jr.: Nice and clean.
• 3:40
  SPEAKER_00: Right.
• 3:40
  SPEAKER_00: But your company just bought a manufacturing firm.
• 3:43
  SPEAKER_00: Let's call them uh factory core.
• 3:45
  SPEAKER_01: Okay.
• 3:45
  SPEAKER_01: Factory core.
• 3:46
  SPEAKER_00: And factory core is decidedly old school.
• 3:48
  SPEAKER_00: I mean, they don't have an UNT-ID tenant, they don't use cloud identity, they just have traditional Active Directory servers sitting in a hum-cooled server room next to the assembly line.
• 3:56
  SPEAKER_01: Aaron Powell It is an incredibly common reality.
• 3:59
  SPEAKER_01: You see this in industrial acquisitions, healthcare, uh, regional finance, you see this everywhere.
• 4:04
  SPEAKER_01: And historically, the instinct here, uh you know, the legacy approach was to initiate a massive Active Directory forest consolidation project.
• 4:13
  SPEAKER_00: Aaron Powell Which, if you've ever lived through one, is just a multi-year nightmare of politics and IP conflicts.
• 4:20
  SPEAKER_00: I mean, if I'm sitting in the architect's chair, my first instinct is to actively avoid a domain migration at all costs.
• 4:26
  SPEAKER_01: Aaron Powell You absolutely must avoid it if you want day one synergies.
• 4:29
  SPEAKER_01: I mean, let's look at the mechanics of why forest consolidation is so toxic to a rapid merger.
• 4:34
  SPEAKER_01: Trevor Burrus, Jr.
• 4:34
  SPEAKER_00: Yeah.
• 4:34
  SPEAKER_00: Break that down.
• 4:36
  SPEAKER_01: So in the old way, you were trying to wire two completely distinct, complex on-premises networks together, right?
• 4:43
  SPEAKER_01: Right.
• 4:43
  SPEAKER_01: You have to build bidirectional, multiforest trusts over site-to-site VPNs or dedicated express route circuits.
• 4:49
  SPEAKER_01: Instantly you run into overlapping IP subnets.
• 4:52
  SPEAKER_01: Oh, always you have DNS writing nightmares.
• 4:55
  SPEAKER_01: You have to meticulously align firewall rules across dozens of ports just to get the domain controllers to even replicate.
• 5:01
  SPEAKER_00: Not to mention the security and well, the political nightmare.
• 5:04
  SPEAKER_00: Factory core's IT guys suddenly want enterprise admin rights in your forest, and your CISO is just having a panic attack because you have no idea how badly Factory Core's Active Directory is currently infected with malware.
• 5:16
  SPEAKER_01: Precisely.
• 5:16
  SPEAKER_01: It is inherently disruptive.
• 5:18
  SPEAKER_01: It's slow, it requires massive capital expenditure, and it completely delays the actual business integration.
• 5:26
  SPEAKER_01: Which brings us to the modern approach, right?
• 5:28
  SPEAKER_01: Microsoft intra cloud sync.
• 5:30
  SPEAKER_00: Aaron Powell Right, right.
• 5:31
  SPEAKER_00: And we actually did a whole deep dive on the internal architecture of those specific provisioning agents.
• 5:37
  SPEAKER_00: You know, the GMSA requirements, the exact service topologies.
• 5:40
  SPEAKER_00: We did that last month, so we won't repeat that entire architecture today.
• 5:43
  SPEAKER_00: Aaron Ross Powell Right.
• 5:44
  SPEAKER_01: No need to rehash the agent internals.
• 5:46
  SPEAKER_00: Aaron Powell But functionally, for our MA scenario, we are talking about dropping a very lightweight piece of software into Factory Core's environment, correct?
• 5:55
  SPEAKER_01: Yes.
• 5:55
  SPEAKER_01: The philosophy shifts from connecting the networks to connecting the identities via the cloud.
• 6:00
  SPEAKER_01: So you install the IntraCloud provisioning agent onto a domain-joined Windows server inside Factory Core's local environment.
• 6:08
  SPEAKER_01: And the brilliance here is the network path.
• 6:11
  SPEAKER_00: Aaron Powell Oh, because it's outbound only.
• 6:13
  SPEAKER_01: Exactly.
• 6:14
  SPEAKER_01: The agent makes an outbound only connection over port 443 to the Microsoft UNTRA cloud provisioning service.
• 6:20
  SPEAKER_01: There are no inbound firewall ports to open.
• 6:22
  SPEAKER_01: You don't need a site-to-site VPN.
• 6:24
  SPEAKER_00: So Factory Core's network can remain completely isolated and like quarantined from our parent corporate network.
• 6:31
  SPEAKER_00: The agent just securely pulls the local AD, grabs the user objects, encrypts the payload, and just pushes it up to our central UNTRA ID tenant.
• 6:40
  SPEAKER_01: Exactly.
• 6:40
  SPEAKER_01: It handles disconnected forests beautifully.
• 6:43
  SPEAKER_01: However, you know, when you rely on this architecture, you are trading network complexity for operational boundaries.
• 6:48
  SPEAKER_01: You have to be intimately aware of the hard limits of the cloud sync engine.
• 6:52
  SPEAKER_00: Aaron Powell Let's look at those limits because lightweight usually implies, well, it's ceiling on performance, right?
• 6:57
  SPEAKER_00: What happens if Factory Core isn't just a small factory, but a massive global logistics firm?
• 7:02
  SPEAKER_01: Currently, CloudSync is mathematically constrained.
• 7:05
  SPEAKER_01: It supports synchronizing a maximum of 150,000 objects per domain.
• 7:10
  SPEAKER_00: Aaron Powell Okay, 150,000 objects.
• 7:13
  SPEAKER_00: And to be clear for you listening, objects doesn't just mean humans logging in, right?
• 7:17
  SPEAKER_01: Aaron Powell Correct.
• 7:18
  SPEAKER_01: An object is a user, it's a service account, a mail contact, or a security group.
• 7:22
  SPEAKER_01: So if Factory Core has, say, 80,000 employees but 75,000 distribution lists and security groups, you will hit that ceiling and the sync engine will start throwing hard errors.
• 7:33
  SPEAKER_00: Oh wow.
• 7:34
  SPEAKER_01: Yeah, it just refuses to provision new objects.
• 7:36
  SPEAKER_00: Aaron Powell Wait, speaking of groups, what about group sizes?
• 7:39
  SPEAKER_00: Because I've seen legacy environments where they have an all-company nested group that has been growing like a digital fungus since like 2005.
• 7:47
  SPEAKER_01: Aaron Powell That is the second hard limit and honestly often the more dangerous one in an MA.
• 7:51
  SPEAKER_01: Cloud Sync only supports synchronizing groups with up to 50,000 members.
• 7:55
  SPEAKER_00: 50,000.
• 7:56
  SPEAKER_00: Okay.
• 7:56
  SPEAKER_01: Right.
• 7:57
  SPEAKER_01: If the engine attempts to process a group membership list with 50,001 users, the payload exceeds the buffer limit for the agent's microservice architecture.
• 8:05
  SPEAKER_00: Trevor Burrus, Jr.
• 8:05
  SPEAKER_00: It just chokes.
• 8:07
  SPEAKER_01: It does.
• 8:07
  SPEAKER_01: The group sync fails, meaning any cloud applications relying on that group for role-based access control will suddenly just drop access for all those users.
• 8:16
  SPEAKER_00: Man.
• 8:16
  SPEAKER_00: So let me offer an analogy here, and you tell me if I'm off-base.
• 8:20
  SPEAKER_00: Sure.
• 8:20
  SPEAKER_00: If cloud sync has these strict limits, is it essentially just a stripped down lead version of the older UNTRA Connect Sync engine, like a software trial version?
• 8:30
  SPEAKER_00: Because if it is, why wouldn't I just deploy the full Connect Sync engine into Factory Core and avoid the NR50,000 object limit entirely?
• 8:38
  SPEAKER_01: Aaron Powell That's a common misconception, but it's fundamentally a different architecture.
• 8:42
  SPEAKER_00: Okay.
• 8:42
  SPEAKER_01: It is not a lead version, it's a shift in state management.
• 8:46
  SPEAKER_01: Think of it this way EnterConnect Sync is like a massive stateful freight train.
• 8:50
  SPEAKER_01: It requires dedicated SQL databases because it holds the entire state of your directory locally before it moves it.
• 8:56
  SPEAKER_01: It processes everything on premises.
• 8:58
  SPEAKER_01: Right.
• 8:58
  SPEAKER_01: CloudSync, on the other hand, is more like a fleet of stateless delivery vans.
• 9:04
  SPEAKER_01: Yeah.
• 9:04
  SPEAKER_01: The state the database of who has been synced and what their attributes are is held entirely in the Microsoft cloud.
• 9:10
  SPEAKER_01: The agent itself is completely disposable.
• 9:13
  SPEAKER_00: Ah, okay.
• 9:13
  SPEAKER_00: So if a delivery van breaks down, like if the factory core server hosting the agent just dies, I just spin up a new van, register it, and it immediately pulls the state from the cloud and resumes.
• 9:26
  SPEAKER_01: Exactly.
• 9:26
  SPEAKER_00: Whereas if my freight train derails, I'm restoring SQL databases from backups.
• 9:30
  SPEAKER_01: Aaron Powell Precisely.
• 9:31
  SPEAKER_01: You use the delivery van's cloud sync for rapid MA onboarding because they are fast to deploy and highly resilient.
• 9:38
  SPEAKER_01: But you keep the freight train connect sync around because sometimes you genuinely need to move a skyscraper.
• 9:43
  SPEAKER_01: Right.
• 9:43
  SPEAKER_01: Cloud Sync, for instance, does not currently support synchronizing device objects for hybrid Azure AD join or complex pass-through authentication where the cloud has to maintain a persistent real-time socket to the on-premises domain controller to validate passwords, you know, frame by frame.
• 9:59
  SPEAKER_00: Okay, so you really have to strictly map your technical requirements before choosing the vehicle.
• 10:04
  SPEAKER_00: Let's assume factory core fits the parameters.
• 10:06
  SPEAKER_00: We deploy the agile delivery vans, we are syncing their active directory up to our UNTRA ID tenant, but in MA, data is never clean.
• 10:14
  SPEAKER_01: Never.
• 10:15
  SPEAKER_00: Let's talk about edge cases.
• 10:17
  SPEAKER_00: What happens when identities collide?
• 10:18
  SPEAKER_00: Say Factory Core has a user named John Smith, Logan named J Smith, and our parent company already has a J Smith.
• 10:24
  SPEAKER_00: They are both going into the same UNTRA ID tenant.
• 10:27
  SPEAKER_01: This is where we descend into the deep identity math.
• 10:30
  SPEAKER_00: Let's do it.
• 10:30
  SPEAKER_01: At the cloud boundary, you aren't really syncing a user.
• 10:34
  SPEAKER_01: You are establishing a mathematical, cryptographic mapping between an on-premises active directory object and an UNTRA ID cloud identity.
• 10:44
  SPEAKER_01: And that mapping relies on what we call a stable join key.
• 10:47
  SPEAKER_00: Right, because if John Smith gets married and changes his name to John Miller, his logon name might change to J Miller, but the system needs to know it's the exact same human being.
• 10:57
  SPEAKER_01: Exactly.
• 10:58
  SPEAKER_01: The sync engine doesn't track names, it tracks the immutable anchor.
• 11:02
  SPEAKER_01: In a standard Microsoft hybrid identity deployment, this anchor is derived from the object GUID in the local Active Directory.
• 11:09
  SPEAKER_00: The GID.
• 11:10
  SPEAKER_01: Right.
• 11:10
  SPEAKER_01: That GUID is a globally unique 128-bit integer assigned when the account is created.
• 11:16
  SPEAKER_01: The sync engine reads the object GID, performs base 64 encoding on it, and maps it to a cloud attribute called the on-premises immutable ID.
• 11:26
  SPEAKER_01: As long as that math holds, the cloud knows exactly who the user is, regardless of what attributes change.
• 11:32
  SPEAKER_00: So in our JSMI collision scenario, because they are two distinct human beings created in two distinct active directories, their object GIDs are completely different.
• 11:40
  SPEAKER_00: Correct.
• 11:41
  SPEAKER_00: So the sync engine will base 64 encode them into two different on-premises immutable IDs, and IntraID will happily create a second user, maybe appending a number to the UPN, like JSmith2 at parentcompany.com.
• 11:53
  SPEAKER_01: You've got it.
• 11:54
  SPEAKER_01: The system inherently prevents accidental overlap.
• 11:56
  SPEAKER_01: But let's look at a much more dangerous edge case.
• 11:59
  SPEAKER_01: One that Microsoft had to explicitly address with a major security hardening update in July 2026.
• 12:04
  SPEAKER_00: Oh, this is the hard matching thing, right?
• 12:06
  SPEAKER_01: Yes.
• 12:06
  SPEAKER_01: This involves hard matching and source of authority abuse.
• 12:10
  SPEAKER_00: Now we're getting into the dark arts.
• 12:12
  SPEAKER_00: Source of authority abuse.
• 12:14
  SPEAKER_00: What is the actual exploit path here?
• 12:16
  SPEAKER_01: Historically, UNTRA ID tried to be helpful.
• 12:19
  SPEAKER_00: Dangerous word in IT.
• 12:21
  SPEAKER_01: Very.
• 12:21
  SPEAKER_01: If the sync engine pushed a new object up from an active directory, and UNTRA ID saw that the base 64 encoded on-premises immutable ID exactly matched the immutable ID of an existing cloud user, UNTRA ID would assume, ah, this is the same user.
• 12:36
  SPEAKER_01: The on-premises directory is now managing them.
• 12:39
  SPEAKER_00: It just assumed trust.
• 12:40
  SPEAKER_01: Right.
• 12:40
  SPEAKER_01: It would perform a hard match and transfer the source of authority for that cloud object to the on-premises Active Directory.
• 12:47
  SPEAKER_00: Okay, so the local domain controller basically shouts, I am the boss of this identity now, and the cloud just accepts it.
• 12:53
  SPEAKER_00: I can already see how an attacker could weaponize that helpfulness.
• 12:56
  SPEAKER_01: It was a devastating attack vector, particularly in MA.
• 13:00
  SPEAKER_01: Imagine you acquire Factory Core, you deploy the cloud sync agents.
• 13:03
  SPEAKER_01: What you don't know is that a nation-state actor compromised Factory Core's active directory six months ago.
• 13:09
  SPEAKER_00: Because they have terrible legacy security, which is uh exactly why we didn't want to do a forest trust in the first place.
• 13:14
  SPEAKER_01: Precisely.
• 13:15
  SPEAKER_01: The attacker is sitting inside Factory Core's network.
• 13:18
  SPEAKER_01: They do some reconnaissance and find the user principal name of a highly privileged cloud administrator in your parent UNTRA ID tenant.
• 13:26
  SPEAKER_00: Oh no.
• 13:27
  SPEAKER_01: Yeah.
• 13:28
  SPEAKER_01: Using basic on-premises tools like ADSI edit, the attacker modifies a standard Factory Core user account.
• 13:35
  SPEAKER_01: They manually overwrite a specific attribute, usually the MSDS consistency grid, so that when the sync engine runs its base 64 math, the resulting string perfectly matches the on-premises immutable ID of your cloud administrator.
• 13:48
  SPEAKER_00: Oh man.
• 13:49
  SPEAKER_00: So the agent pulls the directory, picks up this modified user, encrypts the payload, pushes it to the cloud.
• 13:55
  SPEAKER_01: The cloud receives it, sees the matching immutable ID, triggers the heart match logic, and silently hands over the source of authority.
• 14:01
  SPEAKER_01: Suddenly, the attacker's local compromised active directory account is cryptographically linked to your highest privileged cloud account.
• 14:09
  SPEAKER_01: The attacker resets the password on premises, the sync engine pushes the new password hash to the cloud, and the attacker completely bypasses your cloud native conditional access and MFA.
• 14:20
  SPEAKER_00: That is absolutely terrifying.
• 14:21
  SPEAKER_00: You just handed the keys to your entire cloud kingdom to an attacker hiding in a dusty server room three states away.
• 14:28
  SPEAKER_00: So how did the July 2026 update fix this?
• 14:31
  SPEAKER_01: Well, Microsoft recognized the severe risk this posed to multiforest and MA architectures.
• 14:36
  SPEAKER_01: As of the 2026 updates, IntraID now enforces explicit security hardening on the on-premise object identifier mapping.
• 14:44
  SPEAKER_01: Okay.
• 14:44
  SPEAKER_01: The system will now categorically block attempts to remap an existing UNTRA ID user to a different on-premises identity, particularly if that cloud user holds privileged directory roles, or, you know, if if the system detects an unnatural shift in the sync anchor payload.
• 14:58
  SPEAKER_00: Okay, but wait, let's look at the operational fallout here.
• 15:01
  SPEAKER_00: If intra is just hard blocking these operations, aren't we going to see massive sync failures across the board during a messy AD migration?
• 15:11
  SPEAKER_00: I mean, admins make mistakes.
• 15:13
  SPEAKER_00: They delete objects and have to recover them.
• 15:15
  SPEAKER_00: If I'm on the help desk, how do I differentiate a malicious nation-state attack from a sysadmin who just made a typo and genuinely needs to fix a broken join key mapping?
• 15:26
  SPEAKER_01: That is the exact tension between security and usability.
• 15:29
  SPEAKER_01: When the system blocks this now, it does not fail silently.
• 15:32
  SPEAKER_01: It throws a very specific, explicit error in the UNTRA ID provisioning logs.
• 15:37
  SPEAKER_00: What does it say?
• 15:38
  SPEAKER_01: It says hard match operation blocked due to security hardening.
• 15:41
  SPEAKER_01: Review on-premise object identifier mapping.
• 15:43
  SPEAKER_00: Okay, so I get the alert.
• 15:44
  SPEAKER_00: But my sysadmin genuinely needs to recover a user where the mapping broke.
• 15:49
  SPEAKER_00: Are they just permanently locked out of that cloud identity?
• 15:52
  SPEAKER_01: No, but the recovery path is deliberately painful to prevent automated exploitation.
• 15:57
  SPEAKER_01: You can no longer just fix the attribute in Active Directory and hope the sync engine overwrites it.
• 16:01
  SPEAKER_00: So what's the fix?
• 16:02
  SPEAKER_01: The parent company's administrator must authenticate to the Microsoft Graph API with high privileges.
• 16:08
  SPEAKER_01: They have to execute a targeted payTCH request to the user endpoint, intentionally setting the on-premises immutable ID attribute to a null payload.
• 16:17
  SPEAKER_00: Ah, so you have to explicitly sever the cryptographic tie from the cloud side first.
• 16:22
  SPEAKER_01: Exactly.
• 16:22
  SPEAKER_01: By forcing the attribute to null via the graph ATI, the administrator is cryptographically declaring, I acknowledge this user is currently orphaned.
• 16:30
  SPEAKER_01: Then, on the next polling cycle, the sync engine sees the null value, reads the corrected on-premises anchor, generates a fresh mapping, and successfully provisions the user.
• 16:39
  SPEAKER_01: That's smart.
• 16:40
  SPEAKER_01: It forces the administrator to prove they know exactly what they are doing, moving the action from implicit trust to explicit verification.
• 16:47
  SPEAKER_00: I love that.
• 16:48
  SPEAKER_00: It forces you to operate with intention.
• 16:49
  SPEAKER_00: Okay, so that's the messy reality of acquiring an on-premises organization.
• 16:53
  SPEAKER_00: We avoid the nightmare of network overlap by using stateless cloud sync agents.
• 16:58
  SPEAKER_00: We watch out for the 150,000 object and 50,000 group member limits, and we understand the deep math of join keys so we aren't blindsided by the new security hardening blocks.
• 17:08
  SPEAKER_01: That establishes our baseline perfectly.
• 17:11
  SPEAKER_01: But as you know, not every acquisition target is running legacy tech.
• 17:14
  SPEAKER_00: Right.
• 17:15
  SPEAKER_00: So let's give it to scenario two.
• 17:17
  SPEAKER_00: What if we acquire a modern cloud-first company?
• 17:21
  SPEAKER_00: Like they already have their own UNTRA ID tenant.
• 17:24
  SPEAKER_00: They use Microsoft 365.
• 17:26
  SPEAKER_00: Now, theoretically, this should be easier, right?
• 17:28
  SPEAKER_00: You'd think cloud to cloud.
• 17:30
  SPEAKER_00: I don't have to install any agents on dusty servers.
• 17:32
  SPEAKER_00: Can't we just run a PowerShell script to merge the two tenants together over the weekend?
• 17:36
  SPEAKER_01: If you attempt that, you will be updating your resume on Monday.
• 17:39
  SPEAKER_00: Seriously.
• 17:40
  SPEAKER_01: Cloud-to-cloud consolidation is exponentially harder than on-premises integration.
• 17:44
  SPEAKER_00: But why?
• 17:45
  SPEAKER_00: It's all just data in Microsoft's data centers.
• 17:47
  SPEAKER_01: Because of a concept identity architects call inertia.
• 17:51
  SPEAKER_01: Think about what an UNTRA ID tenant actually is.
• 17:54
  SPEAKER_01: It is not just a flat LDAP directory of usernames and passwords.
• 17:58
  SPEAKER_01: It is the central nervous system, the absolute control plane for that company's entire digital existence.
• 18:04
  SPEAKER_01: Every identity is inextricably bound to a specific tenanted.
• 18:09
  SPEAKER_00: So it's not just about the user object, it's about the uh the web of permissions attached to that object.
• 18:14
  SPEAKER_01: Aaron Powell Exactly.
• 18:14
  SPEAKER_01: Look at the inertia.
• 18:16
  SPEAKER_01: That tenanted is stamped into their Azure subscriptions.
• 18:19
  SPEAKER_01: It's hard-coded into the SAML signing certificates for their third-party Sauce applications like Salesforce or Workday.
• 18:25
  SPEAKER_01: Oh wow.
• 18:26
  SPEAKER_01: It defines the cryptographic boundary for their team's chat histories, their SharePoint site permissions, their conditional access policies, their in-tune device registrations.
• 18:36
  SPEAKER_01: If you try to just rip a user out of tenant B and drop them into tenant A, you break everything.
• 18:41
  SPEAKER_00: Total chaos.
• 18:42
  SPEAKER_01: Total chaos.
• 18:43
  SPEAKER_01: The object IDs change, the SAML assertions fail because the issuer URI doesn't match.
• 18:48
  SPEAKER_01: The user literally loses access to their entire digital workspace.
• 18:52
  SPEAKER_00: So a full tenant consolidation actually merging everyone into one single UNTRA ID tenant.
• 18:58
  SPEAKER_00: How is that even done if it breaks so much?
• 19:00
  SPEAKER_01: With extreme pain, massive organizational downtime, and millions of dollars spent on specialized third-party migration tools like Quest or BitTitan, you have to painstakingly migrate, exchange mailboxes, re-register every single enterprise application, issue new in-tune policies to wipe and re-enroll every physical laptop, and migrate Azure subscription ownership across tenant boundaries.
• 19:22
  SPEAKER_01: It takes months of planning for a single cut over weekend.
• 19:26
  SPEAKER_01: And the end user friction is astronomical.
• 19:29
  SPEAKER_00: Okay.
• 19:29
  SPEAKER_00: Nobody has the appetite for that in a modern agile business acquisition.
• 19:34
  SPEAKER_00: The board expects integration immediately.
• 19:37
  SPEAKER_00: So if full consolidation is off the table, what is the modern architectural alternative?
• 19:42
  SPEAKER_01: The alternative is multi-tenant coexistence.
• 19:45
  SPEAKER_01: We stop trying to force them into a single box.
• 19:47
  SPEAKER_01: Instead, we let the acquired tenant live side by side with the parent tenant, and we weave a highly automated governance and synchronization fabric between them.
• 19:55
  SPEAKER_00: Okay, let's unpack this fabric.
• 19:56
  SPEAKER_00: Because when people hear multi-tenant coexistence, they immediately think of B2B collaboration.
• 20:00
  SPEAKER_00: And I've lived through standard B2B rollouts.
• 20:03
  SPEAKER_00: It is an operational nightmare at scale.
• 20:06
  SPEAKER_00: I have to generate an invitation link, email it to the user and the other tenant.
• 20:09
  SPEAKER_00: They have to click redeem, consent to the privacy policy, and only then does the system instantiate a guest object with a user type of guest in my directory.
• 20:18
  SPEAKER_00: That does not scale for a 5,000-person acquisition.
• 20:21
  SPEAKER_00: You're relying on end users to click links to build your corporate directory.
• 20:25
  SPEAKER_01: You are absolutely right, and that is a crucial distinction we must draw.
• 20:28
  SPEAKER_01: B2B collaboration is the underlying protocol.
• 20:31
  SPEAKER_01: It is the mechanism for how external users authenticate across tenant boundaries using OIDC or SAMILA.
• 20:38
  SPEAKER_01: Okay.
• 20:38
  SPEAKER_01: But it is not an orchestration engine.
• 20:40
  SPEAKER_01: If you rely purely on B2B, your IT team will spend their entire lives writing custom PowerShell scripts just to handle the lifecycle management of those guest accounts.
• 20:49
  SPEAKER_00: So how do we bypass that redemption requirement?
• 20:51
  SPEAKER_00: What is the automation layer?
• 20:52
  SPEAKER_01: The automation layer is Microsoft intra-cross tenant synchronization.
• 20:57
  SPEAKER_01: This is an entirely different beast.
• 20:59
  SPEAKER_01: It is a scalable engine that automates the provisioning, updating, and deprovisioning of B2B users across tenants, completely invisible to the end user.
• 21:09
  SPEAKER_01: There are no invitation emails, there are no redemption prompts.
• 21:12
  SPEAKER_00: So if I'm the architect, I configure cross-tenant sync, and the engine essentially acts as a robotic administrator.
• 21:18
  SPEAKER_00: It reaches across the boundary, reads the user objects in the acquired company's tenant, and automatically projects them into my parent directory.
• 21:26
  SPEAKER_01: Precisely.
• 21:26
  SPEAKER_01: And it maintains the lifecycle state.
• 21:28
  SPEAKER_01: If an employee at the acquired company gets a promotion and their job title changes in their home tenant, cross-tenant sync pushes that attribute update to the guest object in your parent tenant within 40 minutes.
• 21:39
  SPEAKER_01: That's fast.
• 21:40
  SPEAKER_01: It is.
• 21:41
  SPEAKER_01: Crucially, if that employee is terminated, the moment their account is disabled in their home tenant, the sync engine fires an update that instantly blocks sign in on the guest object in your parent tenant.
• 21:51
  SPEAKER_01: You completely eliminate the orphaned access risk.
• 21:53
  SPEAKER_00: That is massive for security compliance.
• 21:56
  SPEAKER_00: But wait, I want to drill into the RSAC 2026 Update you mentioned in the sources.
• 22:01
  SPEAKER_00: Because syncing users is great, but assigning permissions to 5,000 individual users one by one is still a nightmare.
• 22:09
  SPEAKER_00: Did they solve the group problem?
• 22:11
  SPEAKER_01: They did, and it is a massive architectural leap.
• 22:14
  SPEAKER_01: At RSAC 2026, Microsoft announced cross-tenant group synchronization.
• 22:20
  SPEAKER_00: So I can sync the container, not just the users inside it.
• 22:22
  SPEAKER_01: Exactly.
• 22:23
  SPEAKER_01: Previously, cross-tenant sync could only project user objects.
• 22:27
  SPEAKER_01: If the acquired company had a security group called, say, financial auditors, you could sync the users, but you had to manually recreate the financial auditors group in the parent tenant and painstakingly maintain the membership logic.
• 22:38
  SPEAKER_01: Trevor Burrus, Jr.
• 22:39
  SPEAKER_00: Which defeats the purpose of automation.
• 22:41
  SPEAKER_01: Right.
• 22:41
  SPEAKER_01: Now the engine can read the entire security group in the source tenant and project a mirrored security group into the target tenant, dynamically keeping the membership synchronized.
• 22:50
  SPEAKER_00: But wait, if we peek under the hood of how Windows and Enter handle authorization, permissions are tied to the security identifier, the SID, or the object ID in the cloud.
• 23:00
  SPEAKER_00: If you project a group across a tenant boundary, it's going to get a brand new object ID in the parent tenant.
• 23:08
  SPEAKER_00: How does anything know it's the same group?
• 23:10
  SPEAKER_01: Aaron Powell That is the beauty of the design.
• 23:12
  SPEAKER_01: You are right.
• 23:12
  SPEAKER_01: It gets a new object ID in the parent tenant, but you don't need it to match the old one because you use the new mirrored group to assign access to resources residing in the parent tenant.
• 23:22
  SPEAKER_01: Oh, I see.
• 23:22
  SPEAKER_01: The acquired users log into their home tenant, cross the B2B boundary, the parent tenant reads their B2B guest token, sees they are a member of the mirrored financial auditors group, and grants them access to the parent company's financial apps.
• 23:35
  SPEAKER_01: You govern access without ever duplicating a single human identity.
• 23:39
  SPEAKER_00: That is incredibly elegant.
• 23:40
  SPEAKER_01: Yes.
• 23:41
  SPEAKER_00: But uh it brings up a massive liability question.
• 23:44
  SPEAKER_00: If I am the parent company, I am now legally liable for the security of a whole other UNTRA-ID tenant that I might not fully control.
• 23:52
  SPEAKER_00: I can project their users, sure.
• 23:54
  SPEAKER_00: But how do I make sure the acquired company isn't doing something reckless in their home tenant, like disabling multi-factor authentication or allowing users to bypass conditional access?
• 24:04
  SPEAKER_01: This is the governance challenge of multi-tenant coexistence.
• 24:07
  SPEAKER_01: You need visibility and control over environments you didn't build.
• 24:11
  SPEAKER_01: And Microsoft solved this by introducing intra-tenant governance relationships.
• 24:15
  SPEAKER_00: How does that actually work mechanically?
• 24:17
  SPEAKER_00: Do I just demand a global administrator password for their tenant and log in to check their settings?
• 24:22
  SPEAKER_01: No, no.
• 24:23
  SPEAKER_01: That violates least privilege principles and creates a massive shared credential vulnerability.
• 24:27
  SPEAKER_01: Instead, it is handled programmatically via the Microsoft Graph API.
• 24:32
  SPEAKER_01: The first phase is discovery.
• 24:34
  SPEAKER_01: Using tenant governance features, the parent company can analyze their own B2B signal data to discover shadow IT tenants.
• 24:40
  SPEAKER_00: Shadow IT tenants, like environments the acquired company spun up that their own IT department doesn't even know about.
• 24:46
  SPEAKER_01: Exactly.
• 24:47
  SPEAKER_01: It is shockingly common in acquisitions.
• 24:49
  SPEAKER_01: An engineering team at the acquired company spun up a quick Azure tenant three years ago for a testing project, attached a corporate credit card, invited a few external vendors, and completely forgot about it.
• 25:01
  SPEAKER_01: The tenant governance engine analyzes network traffic and B2B authentication logs to surface these hidden tenants.
• 25:08
  SPEAKER_00: Okay, so we find the hidden skeletons in the closet.
• 25:10
  SPEAKER_00: How do we secure them?
• 25:12
  SPEAKER_01: Once discovered, the parent company initiates a formal governance relationship.
• 25:16
  SPEAKER_01: Through this API handshake, the central IT team can actively monitor the configuration drift of the acquired tenant.
• 25:22
  SPEAKER_01: But more importantly, using the new policy's cross-tenant access policy API endpoints, they can enforce security baselines globally.
• 25:31
  SPEAKER_00: Wait, I can push policy down to a tenant I don't know.
• 25:33
  SPEAKER_01: Yes.
• 25:34
  SPEAKER_01: Once the governance trust is accepted, you define a baseline in a JSON payload.
• 25:38
  SPEAKER_01: For example, a JSON structure that dictates a B2B management policy.
• 25:42
  SPEAKER_01: Right.
• 25:42
  SPEAKER_01: Require Maryland chunker.
• 25:43
  SPEAKER_01: You push this JSON via a put request to the API.
• 25:46
  SPEAKER_01: The engine evaluates the acquired tenant.
• 25:49
  SPEAKER_01: If their local conditional access policies do not meet this baseline, like if they allow single factor auth, the parent baseline acts as a compensating control, forcing compliance before any cross-tenant authentication is allowed.
• 26:02
  SPEAKER_00: That is brilliant.
• 26:03
  SPEAKER_00: It's like a digital supervisor constantly checking the work of the acquired tenant's IT staff.
• 26:08
  SPEAKER_00: If they lower their shields, our API automatically raises them back up.
• 26:12
  SPEAKER_01: Precisely.
• 26:12
  SPEAKER_00: Okay.
• 26:13
  SPEAKER_00: We have covered the theory, we've covered the agents, the sync limits, the JSON payloads, and the API calls.
• 26:18
  SPEAKER_00: Now it is time for the mechanics masterclass.
• 26:22
  SPEAKER_00: Let's put this all together into a concrete end-to-end post-acquisition scenario.
• 26:27
  SPEAKER_01: I am ready.
• 26:27
  SPEAKER_01: Lay out the chessboard.
• 26:29
  SPEAKER_00: All right.
• 26:29
  SPEAKER_00: You are in the war room.
• 26:30
  SPEAKER_00: We have company A, they are the parent company, they have a mature UNTRA ID tenant.
• 26:35
  SPEAKER_00: But crucially, Company A relies on a highly critical legacy on-premises application.
• 26:41
  SPEAKER_00: Let's call it the mainframe gateway.
• 26:42
  SPEAKER_00: It's the lifeblood of their operations, but it does not speak modern cloud protocols.
• 26:48
  SPEAKER_00: It only speaks Legacy Kerberos.
• 26:50
  SPEAKER_00: To secure it and bridge it to the cloud, Company A uses an on-premises application access gateway.
• 26:56
  SPEAKER_00: The source materials mention tools like Okta Access Gateway or CyberArc Workforce Identity.
• 27:02
  SPEAKER_01: Excellent.
• 27:02
  SPEAKER_01: Those are highly capable identity proxies.
• 27:04
  SPEAKER_01: They sit in the DMZ in front of the legacy app.
• 27:07
  SPEAKER_01: They intercept modern OIDC or SAML tokens from the cloud, validate them, and translate them down into legacy headers or Kerberos tickets for the back-end server.
• 27:16
  SPEAKER_00: Exactly.
• 27:17
  SPEAKER_00: Now, Company A just bought Company B.
• 27:19
  SPEAKER_00: Company B is our acquired organization.
• 27:21
  SPEAKER_00: They have their own completely separate enter ID tenant and their own on-premises active directory.
• 27:27
  SPEAKER_01: A classic, highly complex hybrid reality.
• 27:30
  SPEAKER_00: The mission from the board is twofold.
• 27:32
  SPEAKER_00: Goal number one.
• 27:33
  SPEAKER_00: By Monday morning, we need to allow Company B's users to authenticate using their own home enter ID credentials, but they must be able to securely reach Company A's on-premises legacy application through that existing Okta or CyberArc gateway.
• 27:47
  SPEAKER_00: Goal number two.
• 27:52
  SPEAKER_00: We need to establish shared calendars, free busy status, and a unified global address list, the GAL, between the two tenants.
• 28:00
  SPEAKER_01: It is a phenomenal scenario.
• 28:02
  SPEAKER_01: It touches identity, application proxying, and messaging routing, and it is entirely achievable without a single server migration if we sequence it correctly.
• 28:11
  SPEAKER_01: Awesome.
• 28:12
  SPEAKER_01: We will break this down into four concrete steps.
• 28:14
  SPEAKER_01: Step one is establishing the cross-tenant access configuration.
• 28:18
  SPEAKER_00: Okay, if I'm Company A's admin, where do I start?
• 28:21
  SPEAKER_00: Entra ID is fundamentally a walled garden.
• 28:24
  SPEAKER_00: It operates on zero trust.
• 28:26
  SPEAKER_00: By default, it drops any token from a foreign tenant, right?
• 28:29
  SPEAKER_01: Exactly.
• 28:30
  SPEAKER_01: So we have to intentionally puncture that wall, but only for Company B.
• 28:33
  SPEAKER_01: Company A's administrator navigates to the external identities blade, specifically the cross-tenant access settings.
• 28:40
  SPEAKER_01: They configure an inbound trust policy explicitly scoped to Company B's unique tenant ID.
• 28:45
  SPEAKER_00: What does that policy actually do at the protocol level?
• 28:48
  SPEAKER_01: It alters the token validation logic.
• 28:50
  SPEAKER_01: It explicitly dictates when we receive an authentication claim signed by Company B's intra-ID certificate, we will validate the signature and accept the claim.
• 29:00
  SPEAKER_01: Crucially, in this step, the administrator should also configure the policy to trust inbound claims for multi-factor authentication and device compliance.
• 29:14
  SPEAKER_00: If I'm Company A, why wouldn't I force Company B's users to register for MFA in my tenant just to be safe?
• 29:21
  SPEAKER_01: Because you will destroy the user experience and overwhelm your help desk.
• 29:24
  SPEAKER_00: How so?
• 29:25
  SPEAKER_01: If you don't trust the inbound claim, when the company B user tries to access the app, Company A's tenant will intercept the request and say, I see you authenticated, but I don't see an MFA token.
• 29:34
  SPEAKER_01: Register your phone.
• 29:36
  SPEAKER_01: The user is now registering two different authenticator apps for two different tenants.
• 29:39
  SPEAKER_00: Oh, that's terrible.
• 29:40
  SPEAKER_01: It is.
• 29:41
  SPEAKER_01: By trusting the inbound claim, Company B's tenant performs the MFA, injects a specific claim into the OIDC token, usually an error or authentication methods references array containing infa and passes it across.
• 29:54
  SPEAKER_01: Company A reads the token, sees the info claim, and seamlessly allows access.
• 29:59
  SPEAKER_00: Okay, so the trust is established, the tokens can flow, but right now, Company D's users don't exist in Company A's directory.
• 30:07
  SPEAKER_00: We need to run the cross-tenant synchronization we talked about earlier.
• 30:10
  SPEAKER_01: Yes.
• 30:10
  SPEAKER_01: Company A configures the sync job, scopes it to the required users or groups in Company B, and starts the engine.
• 30:17
  SPEAKER_01: Within 40 minutes, those users are automatically projected into Company A's directory as highly managed guest identities.
• 30:23
  SPEAKER_00: Okay.
• 30:23
  SPEAKER_00: Step one is complete.
• 30:25
  SPEAKER_00: But I'm going to push back here because an identity without permissions is basically a digital paperweight.
• 30:29
  SPEAKER_00: Company B's users are sitting in the directory, they have a guest account.
• 30:33
  SPEAKER_00: But how does the legacy Okta or Cyber Gateway actually know what to do with this newly minted guest?
• 30:39
  SPEAKER_00: How do we wire up step two?
• 30:41
  SPEAKER_00: Granting application access.
• 30:43
  SPEAKER_01: Visibility is not authorization.
• 30:45
  SPEAKER_01: To grant access, the company A administrator navigates to the enterprise applications blade in their UNTRA ID tenant.
• 30:52
  SPEAKER_01: They locate the specific service principle, the app registration that represents the Okta Access Gateway or CyberARC appliance.
• 30:59
  SPEAKER_00: And this is where that new RSAC 2026 group sync feature becomes the hero, right?
• 31:05
  SPEAKER_00: Because they don't want to assign 5,000 guest users manually to this app.
• 31:08
  SPEAKER_01: Exactly.
• 31:09
  SPEAKER_01: Assuming they synced the groups in step one, the admin simply takes the mirrored Company B operations security group and assigns it to the gateway application role.
• 31:18
  SPEAKER_00: Let's walk through the actual authentication flow, packet by packet.
• 31:21
  SPEAKER_00: Because this is the magic trick.
• 31:22
  SPEAKER_00: I'm the user at Company B.
• 31:23
  SPEAKER_00: I click a bookmark for the mainframe gateway.
• 31:26
  SPEAKER_00: What happens?
• 31:26
  SPEAKER_01: The browser sends an HTTP GET request to the gateway's external URL.
• 31:31
  SPEAKER_01: The gateway, acting as a service provider, redirects the user to Company A's intra ID for authentication.
• 31:37
  SPEAKER_01: Company A's intra ID sees the login attempt, recognizes the user's UPN suffix belongs to Company B, and performs a home realm discovery redirect.
• 31:46
  SPEAKER_00: So it bounces the user back to their home tenant.
• 31:49
  SPEAKER_01: Yes.
• 31:50
  SPEAKER_01: The user authenticates against Company B's intra ID.
• 31:53
  SPEAKER_01: They perform their MFA.
• 31:55
  SPEAKER_01: Company B issues a token and POSTs it back to Company A.
• 31:59
  SPEAKER_01: Company A validates the signature because of the trust policy we built in step one and then evaluates authorization.
• 32:06
  SPEAKER_00: It checks the groups.
• 32:07
  SPEAKER_01: Right.
• 32:07
  SPEAKER_01: It checks the enterprise app assignments, sees the user is in the authorized guest group, generates a final access token, and passes the user down to the Okta or CyberARC gateway.
• 32:18
  SPEAKER_00: And here is the absolute crux of the mechanics masterclass.
• 32:21
  SPEAKER_00: What does the gateway do with that token?
• 32:23
  SPEAKER_00: Because the back-end mainframe only speaks Kerberos.
• 32:26
  SPEAKER_00: It has no idea what an OIDC token is.
• 32:29
  SPEAKER_01: This is where protocol transition happens.
• 32:31
  SPEAKER_01: The gateway receives the entry token.
• 32:33
  SPEAKER_01: Because the user is a recognized guest with the correct claims, the gateway treats them exactly like a native company A user.
• 32:38
  SPEAKER_01: The gateway extracts the user's identity usually by parsing the user principal name or a custom mapped attribute and performs Kerberos constrained delegation or KCD.
• 32:47
  SPEAKER_00: Ah.
• 32:48
  SPEAKER_00: So the gateway essentially turns around to the on-premises domain controller and says, Hi, I am the Gateway service account.
• 32:55
  SPEAKER_00: I am authorized to request a Kerberos service ticket on behalf of this specific user.
• 32:59
  SPEAKER_01: Precisely.
• 33:00
  SPEAKER_01: The domain controller issues the Kerberos ticket to the gateway.
• 33:03
  SPEAKER_01: The gateway injects that ticket into the HTTP headers or the payload and forwards the traffic to the legacy mainframe.
• 33:10
  SPEAKER_01: The legacy application sitting in a data center parses the Kerberos ticket, authenticates the session, and grants access.
• 33:17
  SPEAKER_01: It has absolutely no idea that a multi-tenant cross-cloud authentication dance just happened.
• 33:24
  SPEAKER_00: That is wild.
• 33:25
  SPEAKER_00: You have securely bridged a modern multi-tenant cloud architecture directly into a legacy Kerberos backend, all without changing a single line of code on the mainframe.
• 33:34
  SPEAKER_00: That is day one integration.
• 33:36
  SPEAKER_01: It is the pinnacle of modern identity proxying.
• 33:39
  SPEAKER_01: But as you mentioned in the scenario requirements, giving them application access doesn't stop the executives from complaining about their calendars.
• 33:45
  SPEAKER_00: Right.
• 33:46
  SPEAKER_00: Goal number two, we need to schedule meetings.
• 33:49
  SPEAKER_00: Step three, calendar-free Willie and global address list sharing.
• 33:53
  SPEAKER_00: If I'm the identity architect, I just go back into UNTRA ID and check a box that says share calendars.
• 33:59
  SPEAKER_01: Right.
• 34:00
  SPEAKER_01: That is a trap that catches many architects.
• 34:09
  SPEAKER_00: Wait, really?
• 34:10
  SPEAKER_00: We just spent the whole deep dive talking about UNTRA ID merging directories.
• 34:14
  SPEAKER_01: We merged the identities for access control.
• 34:17
  SPEAKER_01: But sharing a calendar, calculating free busy time slots, and compiling a unified global address list, the GAL, so users can search for each other in Outlook, well, that is an entirely distinct architectural plane.
• 34:28
  SPEAKER_01: That logic lives strictly at the exchange online layer.
• 34:31
  SPEAKER_00: So identity and messaging are two completely separate silos.
• 34:34
  SPEAKER_01: Yes.
• 34:34
  SPEAKER_01: UNTRA-ID paves the road, but exchange drives the cars.
• 34:38
  SPEAKER_01: To establish free busy sharing, the administrators in both Company A and Company B's Exchange Online tenants must configure what is called an organization relationship.
• 34:47
  SPEAKER_00: What does an organization relationship actually do under the hood?
• 34:50
  SPEAKER_01: It establishes server-to-server OOT authentication.
• 34:54
  SPEAKER_01: When a user in Company A opens Outlook and adds a Company B executive to a meeting invite, Outlook queries the local Exchange Online server.
• 35:02
  SPEAKER_01: The server looks at the organization relationship, identifies the target auto-discover app URL for Company B, and makes a secure API call across the tenant boundary to query the availability data.
• 35:15
  SPEAKER_00: Okay, so that gets us the free busy blocks.
• 35:17
  SPEAKER_00: But what about the global address list?
• 35:20
  SPEAKER_00: How do I actually find the executive's name in the address book in the first place?
• 35:24
  SPEAKER_00: My cross-tenant sync guest objects don't automatically show up in the Outlook GAL, do they?
• 35:29
  SPEAKER_01: Usually no.
• 35:30
  SPEAKER_01: Guest objects are typically hidden from the exchange GAL by default to prevent clutter.
• 35:34
  SPEAKER_01: To achieve a unified address book, you typically deploy a GAL synchronization mechanism.
• 35:40
  SPEAKER_01: This reads the mailboxes in Company B and provisions corresponding mail contact objects in Company A's exchange environment.
• 35:46
  SPEAKER_00: Okay, a mail contact.
• 35:47
  SPEAKER_00: So it's literally just a routing entry in the address book.
• 35:49
  SPEAKER_00: Nobody logs in with a mail contact.
• 35:51
  SPEAKER_01: Exactly.
• 35:51
  SPEAKER_01: It just tells Exchange how to route the SMTP traffic and how to display the name in the directory.
• 35:57
  SPEAKER_01: And the critical organizational reality here, the thing that causes so much friction in MA, is that this entire step is almost exclusively owned by the messaging or exchange team, not the identity team.
• 36:08
  SPEAKER_00: Which means if the identity team builds the cross-tenant trust on Friday, but forgets to tell the messaging team to configure the org relationships, Monday morning is going to be a disaster.
• 36:19
  SPEAKER_00: The apps will work, but the executives will be furious because they can't book a meeting.
• 36:23
  SPEAKER_01: Yep.
• 36:23
  SPEAKER_00: It highlights how communication between IT silos is just as critical as the JSON payloads.
• 36:28
  SPEAKER_01: Spot on.
• 36:29
  SPEAKER_01: Which brings us to the final phase.
• 36:31
  SPEAKER_01: Step four.
• 36:32
  SPEAKER_01: Verification and troubleshooting.
• 36:34
  SPEAKER_01: It's Go Live Day.
• 36:35
  SPEAKER_01: When this architecture works, what does it actually look like?
• 36:38
  SPEAKER_00: Invisible IT is the best IT.
• 36:41
  SPEAKER_00: A successful test means the Company B employee opens their laptop, authenticates to their normal enter ID prompt with the same password and MFA they've always used, opens Outlook to see full calendar details for Company A, clicks a web bookmark for the mainframe gateway, and gets straight into the legacy app without seeing a single VPN client or a second password prompt.
• 37:01
  SPEAKER_01: That is the gold standard.
• 37:03
  SPEAKER_01: But in complex systems, components fail.
• 37:06
  SPEAKER_01: If you are sitting on the escalation desk, you have to know how to isolate the breakdown across this massive authentication chain.
• 37:12
  SPEAKER_00: Okay, give me the diagnostic tree.
• 37:14
  SPEAKER_00: Problem one.
• 37:21
  SPEAKER_01: If the failure happens before they even reach the application, the breakdown is at the entra ID layer.
• 37:26
  SPEAKER_01: You need to check the UNTRA ID sign-in logs in Company A's tenant.
• 37:30
  SPEAKER_01: You are looking for errors related to the cross-tenant access settings.
• 37:33
  SPEAKER_01: For example, an AAD STS50020 error indicates the user's home tenant isn't authorized, meaning your inbound trust policy is misconfigured, or the B2B guest object wasn't correctly provisioned by the sync engine.
• 37:45
  SPEAKER_00: Okay, problem two.
• 37:56
  SPEAKER_01: If they pass the UNTRA login but hit a wall at the proxy, the breakdown is an authorization or protocol transition.
• 38:03
  SPEAKER_01: First, verify the RSAC group sync worked.
• 38:06
  SPEAKER_01: Is their guest object actually a member of the enterprise app role?
• 38:10
  SPEAKER_01: Right.
• 38:11
  SPEAKER_01: If yes, check the gateway's system logs.
• 38:14
  SPEAKER_01: Did the gateway successfully extract the UPN from the cloud token?
• 38:18
  SPEAKER_01: Did the Kerberos constrained delegation fail because the gateway service account doesn't have permissions in the on-premises Active Directory to request a ticket for that specific user?
• 38:27
  SPEAKER_00: Ah, right, because the local AD still has to issue the Kerberos ticket.
• 38:30
  SPEAKER_00: Yeah.
• 38:31
  SPEAKER_00: It's a classic failure point.
• 38:32
  SPEAKER_00: Finally, problem three.
• 38:33
  SPEAKER_00: The user can access the mainframe perfectly, but they call the help desk screaming that they can't see the CEO's calendar.
• 38:39
  SPEAKER_01: Then the identity team can put their feet up on the desk because that breakdown is strictly in the exchange layer.
• 38:45
  SPEAKER_01: The UNTRA ID trust is working perfectly.
• 38:48
  SPEAKER_01: You tell the help desk to escalate to the messaging team to trace the organization relationship O token or verify the GAL SYNC provisioning.
• 38:56
  SPEAKER_00: You are teaching corporate IT survival skills right there.
• 39:00
  SPEAKER_00: Deflect to the messaging team.
• 39:02
  SPEAKER_01: Always.
• 39:03
  SPEAKER_00: Well, we have covered an immense amount of ground today.
• 39:05
  SPEAKER_00: We have torn down the hidden plumbing of MA integrations.
• 39:09
  SPEAKER_00: If you are an architect facing a merger, you now know how to bypass those agonizing Active Directory consolidation projects by deploying stateless cloud sync agents.
• 39:20
  SPEAKER_01: Absolutely.
• 39:20
  SPEAKER_00: You understand the math behind join keys and why Microsoft Security Hardening will explicitly block hard match source of authority abuse to keep your privileged account safe.
• 39:28
  SPEAKER_00: You can distinguish the manual pane of B2B guest collaboration from the powerful automation of cross-tenant sync, including the new group mirroring, and you have walked step by step through a complex proxy architecture that translates multi-tenant cloud auth into legacy Kerberos while keeping your identity and messaging planes distinct.
• 39:46
  SPEAKER_00: That's a wrap on day one of the MA.
• 39:48
  SPEAKER_00: How does integration start on Microsoft Entra?
• 39:52
  SPEAKER_00: We closed on the full recap.
• 39:54
  SPEAKER_00: Join Key Math, the hard match defense that shut down a real attack vector, cross-tenant sync versus B2B, and the Kerberos bridge that keeps your identity and messaging planes separate.
• 40:07
  SPEAKER_00: But day one access is only half the story.
• 40:11
  SPEAKER_00: Next episode.
• 40:16
  SPEAKER_00: Here's how Microsoft Entra actually secures it.
• 40:19
  SPEAKER_00: Find the show notes and connect with Ernie on LinkedIn.
• 40:22
  SPEAKER_00: Link in the description.
• 40:23
  SPEAKER_00: Subscribe if you're planning your own integration.
• 40:26
  SPEAKER_00: Until next time.