Our healthcare organization works closely with another organization, and many employees have accounts in both Entra tenants. Cross-tenant access has been configured, including trust settings for compliant devices and hybrid joined devices. In the past, these users could sign in to computers joined to either on-premises Active Directory domain, but both organizations have now moved to cloud-only identities and Entra-joined devices. Can a user whose account belongs to Tenant B interactively sign in to a Windows device that is Entra joined to Tenant A? The sign-in appears to fail because the device object exists only in Tenant A. Do cross-tenant access and device-trust features support Windows desktop logon in this situation, or are they intended only for accessing applications and resources? Is this supported, or would the user need a separate device or virtual desktop in their home tenant?
2 Answers
The home tenant remains the trust boundary for device sign-in, much like the domain relationship used to be for traditional domain-joined computers. Cross-tenant synchronization and compliant-device trust do not turn a device joined to Tenant A into a sign-in device for users whose identities belong to Tenant B. A virtual desktop in the resource or home tenant, or a separate device joined to the appropriate tenant, is the more supportable design.
Cross-tenant access and B2B trust are mainly for applications and resources. Interactive Windows sign-in on an Entra-joined device still depends on the user's home tenant being able to recognize and trust that device. If the computer exists only in Tenant A, a Tenant B user generally cannot complete the Windows logon flow because the required device identity and primary refresh token relationship are missing. In practice, users can access services from the Tenant A device through guest access, but their full desktop work needs a separate device or a Cloud PC hosted in Tenant B.
That matches what I am seeing. If the device is not registered in the user's home tenant, the sign-in failure is expected rather than something cross-tenant synchronization can resolve.
I am collecting this information to help set expectations and explain why the new device workflow needs to change. A separate joined device or hosted desktop appears to be the practical approach.