About Multi-Tenancy Permissions with AAD
When using AAD User Groups to control access to your multi-tenancy environment, organization administrators must belong to two groups:
- A user group that grants either Full Access, Restricted, Read-Only, or Invite Only permissions.
An administrator on a single tenant likewise belongs to two groups: one of the permission level groups defined above, and one group to control access to that tenant.
The example below shows some sample users belonging to different AAD groups. Note that MT Admins retain permissions across all of an organization's tenants:
