Device compliance in multitenant for CSP

Question

Hello all,

I have two existing tenants:

1. TenantA - Work tenant, containing all my data and services and my work account
2. TenantB - Admin tenant, containing our tools for our IT activity toward our customers and my admin account.

Let say work@tenantA and admin@tenantB.
Our tenantB is our Cloud Service Provider tenant containing our customer infrastructure access, so is highly sensisive.

Both tenants have their own AAD, name, AAD Connect, nothing is linked, no trust.

All our devices are registered in TenantA and managed for access our company data and such. Conditional Access is in place in this TenantA with MFA requirement and other stuffs.

I need to secure TenantB to require both MFA/Passwordless AND a compliant device

We don't want a second device, and especially no VDI as they would be onprem and defeating the public cloud meaning :D

How can I onboard my device on both tenant without the Hybrid device join (https://learn.microsoft.com/en-us/azure/active-directory/devices/howto-hybrid-azure-ad-join) because this is not what we need as accounts need to be split and not synch from the same AD/Forest.

I'm working on it for a week without a solution, is this even possible?

Answer 1

@Adrien Maugard, Thanks for posting in Q&A. From Intune side, it is not recommended to enroll the same device into two different Intune tenants. It will cause issues like policy receiving and etc. I think you still need to consider managing these devices in one tenant.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.