📋 Microsoft Entra Documentation Changes

description: Learn about cross-tenant delegated administration and how it enables centralized management across tenants in Microsoft Entra

ms.date: 03/10/2026

<!-- source: Cross-tenant delegated administration.docx -->

Cross-tenant delegated administration is a capability within Tenant Governance that enables administrators to monitor and manage multiple tenants using accounts from a central governing tenant. Administrators don't need to create local accounts or business-to-business (B2B) guest accounts in every governed tenant. This capability uses granular delegated admin privileges (GDAP) technology to provide secure, least-privileged access across tenant boundaries.

Before you can use cross-tenant delegated administration, you must first create a governance relationship between the governing tenant and each governed tenant. The governance relationship establishes the trust boundary. It also defines the delegated administration policies that control which roles and permissions are available to governing tenant administrators.

Cross-tenant delegated administration also gives governed tenants full visibility into governing tenant admin activity within their environment. The governed tenant's sign-in and audit logs capture all actions that delegated administrators perform, ensuring that governed tenant stakeholders can independently monitor, review, and audit administrative operations.

## How cross-tenant delegated administration works

ms.date: 04/03/2026

# Turn on universal tenant restrictions

Universal tenant restrictions enhance the functionality of [tenant restrictions v2](https://aka.ms/tenant-restrictions-enforcement). They use Global Secure Access to tag all traffic no matter the operating system, browser, or device form factor. They allow support for both client and remote network connectivity.

Administrators no longer have to manage proxy server configurations or complex network configurations. They can apply tenant restrictions v2 on any platform by using the Global Secure Access client or remote networks.

 

When you enable universal tenant restrictions, Global Secure Access adds policy information for tenant restrictions v2 to the authentication plane's network traffic. This traffic is from Microsoft Entra ID and Microsoft Graph. As a result, users who use devices and networks in your organization must use only authorized external tenants. This restriction helps prevent data exfiltration for any application integrated with your Microsoft Entra ID tenant through single sign-on (SSO).

 

ms.date: 03/10/2026

After the governance relationship is active and GDAP role assignments are in place, members of the configured security group can sign in to the governed tenant.

1. Confirm that your account is a member of a security group in the governing tenant that is assigned roles in the governance policy template.

`https://entra.microsoft.com/{governed-tenant-domain-or-id}`

With customized emails, you're able to include dynamic attributes within the subject and body to personalize these emails. The list of dynamic attributes that can be included are as follows:

|userDisplayName | The user’s display name. |

|userEmployeeHireDate | The user’s employee hire date. |

|userEmployeeLeaveDateTime | The user’s employee leave date and time. |

|managerDisplayName | The display name of the user’s manager. |

|temporaryAccessPass | The generated Temporary Access Pass. Only available with the **Generate TAP And Send Email** task. |

|userPrincipalName | The user’s userPrincipalName. |

|managerEmail | The manager’s email. |

|userSurname | User’s family name. |

|userGivenName | User’s first name. |

ms.date: 03/05/2026

## Step 4: Classify the related tenant

ms.date: 06/10/2026

A temporary opt-out will be available for the September 1, 2026 through February 1, 2027 changes. This allows you to delay passkey and Registration Campaign enablement while you complete transition activities, such as configuring customer-managed telecom providers or migrating to other authentication methods. API support and information for opting out will be available starting August 1, 2026.

To further personalize customized emails, you can take advantage of dynamic attributes. By placing dynamic attributes in your emails, you can specifically call out values such as a user's name, their generated Temporary Access Pass, or even their manager's email.

To use dynamic attributes within your customized emails, you must follow formatting rules. The proper format is:

`{{dynamic attribute}}`

Welcome to the team, {{userGivenName}}

ms.date: 09/15/2025

Conditional Access policies that require MFA registration don't function as expected when an External ID tenant is federated with an external identity provider (IdP). This can result in one of the following behaviors:

- Users are unable to register an MFA method and can't complete sign-in, often encountering an error.

- Users aren't redirected to the MFA registration (sign-up) flow during sign-in as expected.

ms.date: 03/10/2026

 

> [!IMPORTANT]

> There is a known issue on Windows Server 2025 that can cause Microsoft Entra Cloud Sync to encounter synchronization problems. If you're running Windows Server 2025, make sure you have installed [October 20, 2025 - KB5070773](https://support.microsoft.com/topic/october-20-2025-kb5070773-os-build-26100-6901-out-of-band-f8effaa1-1c73-41e5-bcb3-e58a46c7601e) update, or later. After installing this update, restart the server for the changes to take effect.

 

Each group can have multiple role assignments, and each policy template can have multiple groups defined. When you create the governance relationship, Tenant Governance creates [granular delegated admin privileges (GDAP)](/partner-center/customers/gdap-introduction) role assignments in the governed tenant.

1. [Validate Universal Tenant Restrictions enforcement](../global-secure-access/how-to-universal-tenant-restrictions.md#validate-tenant-restrictions-enforcement).