Cross-Tenant Sync Offboarding: What Microsoft’s Known Issues Mean for Your Checklist
Abhishek Sharma · November 13, 2026
Cross-tenant sync removes only the users it provisions, and deletion behavior depends on a setting many admins miss. This guide explains Microsoft’s documented limits, adds a Microsoft 365 offboarding checklist, and covers the February 2027 SMS and voice MFA retirement to plan for now.
When an employee leaves, most Microsoft 365 teams disable the account and remove the license. That covers the home tenant. It may not cover a partner tenant where the same person was synchronized. Cross-tenant synchronization keeps those partner accounts current, but its documented limits matter when someone leaves.
Microsoft’s known issues for provisioning and its multitenant organization limitations describe conditions under which a departure may not reach the partner tenant. This article explains those conditions, gives an offboarding checklist, and covers an authentication change to plan for now.
What Cross-Tenant Sync Provisions
Cross-tenant synchronization copies users from a source tenant into a target tenant. The source tenant configures the rules. Microsoft’s known-issues page states that only internal member users from the source tenant can be provisioned into the target. External users from the home tenant and internal guest users cannot be provisioned by this process. Accounts in a partner tenant that were created by other means are not managed by the sync.
Two other limits apply:
Users enabled for SMS sign-in are skipped. Microsoft states that users enabled for SMS sign-in cannot be synchronized through cross-tenant synchronization.
The target can turn it off. Configuration must be done in the source tenant, and the target administrator can turn off cross-tenant synchronization at any time. If the target stops syncing, departures in the source tenant no longer reach the partner account.
Why Deletion Settings Matter Most
The most important offboarding control is the deletion behavior of the sync job itself. Microsoft’s multitenant organization limitations page states that, by default, when provisioning scope is reduced while a synchronization job is running, users fall out of scope and are soft deleted. The setting that controls this is Target Object Actions for Delete. If it is disabled, users taken out of scope are not deleted in the target tenant.
The same page notes that SkipOutOfScopeDeletions works for application provisioning jobs but not for cross-tenant synchronization. To avoid soft deletion of users taken out of scope, Microsoft recommends setting Target Object Actions for Delete to disabled.
Check this setting before you rely on the sync for offboarding. Your departure process depends on what the job does when a user leaves its scope, not only on the source account being disabled.
Why a Removed User Can Still Be in the Partner Tenant
Based on Microsoft’s documented behavior, four causes stand out:
Synchronization was turned off or changed by the partner. The target administrator can stop cross-tenant synchronization at any time, so departures no longer reach the partner account.
Scope was reduced, and deletion was not enabled. If Target Object Actions for Delete is disabled, a user who falls out of scope is not removed from the target tenant.
The account is a guest or external user. Cross-tenant sync provisions only internal member users from the source tenant. Guest and external accounts must be removed directly in the partner tenant.
The user is an SMS sign-in user. Users enabled for SMS sign-in cannot be synchronized, so the account may have been created or managed by another process.
In each case, the home tenant looks clean. The partner tenant still holds an account, group membership, or resource access. Check the partner tenant directly.
Offboarding Checklist for Microsoft 365
Work through these steps each time someone with cross-tenant access leaves.
Identify every tenant where the person has an account. Search the source tenant for synchronized users, and check each partner tenant for the same identity. Include guest accounts and invitations.
Confirm the sync status for each partner. Check whether cross-tenant synchronization is active, which user scope applies, and whether Target Object Actions for Delete is enabled.
Disable the account at the source and confirm the change reaches the target. Do not rely on the sync alone. Verify that the partner account shows as disabled or removed within the expected time.
Remove accounts the sync did not provision. For each guest, external user, or account created outside the sync, remove the account directly in the partner tenant. Record who did it and when.
Revoke access and sessions. Revoke sign-in sessions, remove group memberships, and review access to shared channels and partner resources.
Check licenses and apps. Remove any licenses assigned in the partner tenant, and review third-party apps that the person authorized.
Record the result. Keep a record of each tenant checked, the action taken, and the time it was completed.
Test the process after the first few changes. Pick a test account, remove it at the source, and check whether the partner tenant reflects the change within the time you expect. If it does not, review the sync scope and deletion setting before the next real departure.
Plan Now for the February 2027 MFA Change
Add an onboarding item to your checklist. Microsoft is retiring its native SMS and voice multifactor authentication in Entra ID. Under message center item MC1426371, passkeys become the default sign-in method starting September 1, 2026, and Microsoft-provided SMS and voice MFA are retired on February 1, 2027. Microsoft’s retirement FAQ sets a later date of July 1, 2027 for Global Administrators and external users, but plan for February regardless.
Users whose only MFA method is SMS or voice will be prompted to register a passkey before they can continue. Customers using a telecom provider configured through the Microsoft Security Store are not affected by the native retirement, but most organizations should not depend on that.
Register passkeys first, then retire SMS and voice methods for users who have them. Include new hires in that process from day one. Also review self-service password reset, because the retirement covers it too. Good practice is to finish this before the February date, not on it.
Where OptyStack Fits
OptyStack’s discovery and access features cover the inventory side of this checklist. It finds SaaS and AI tools using signals from spend, SSO, and browser activity, so applications a departing employee used appear in one list with their owners. Its Pro plan includes user lifecycle management and unused license reclamation, which help remove access and paid seats when someone leaves.
OptyStack does not manage cross-tenant synchronization or change settings in partner tenants. Confirm in a demo whether its lifecycle workflows cover accounts in partner tenants and guest access, because that is the gap this article describes.
To start an inventory for your own environment, you can start a free trial.
