Azure AD - Link between primary and guest accounts in different tenants - azure-active-directory

Question

We are struggling with the use case below, in a highly regulated context where audits are being run on all the Azure AD. Any help appreciated.
Context:
1 main Azure AD tenant in the company, which is an O365 tenant
(labelled as the “users tenant”)
Multiple other Azure AD tenants in
the company, which are the “applications” tenants:
Each
department/business division has its own application tenant (for
isolation purposes), to manage its Azure resources (one or several
subscriptions)
Some users from the users tenant (O365) are invited to
some applications tenants (Azure) as guest accounts
Use case to solve :
Employee is leaving the company and is removed from the “users” tenant (O365)
The company needs to remove this employee from all the “applications” tenants he/she has been added to as a guest account
Is there a way to automatically/programmatically identify and remove all of the accounts of this employee in the different AAD tenants, based on the O365 tenant ?
Is there a public “link” between AAD accounts (primary > guest) that we can leverage to achieve the identification/removal of AAD users ?
Workarounds ? Best practices ?

Answer 1

Based on your description, you can register an multi-tenant app in your main tenant :
After the app created , create a secret for it and note its application ID and secret , we will use it to connect to your tenants later :
Grant "User.ReadWrite.All" permission of Microsoft Graph API to this application as we will call Microsoft Graph API to delete users :
Do not forget to click "Grant admin consent for your tenant " button to finish the assign process.
letting admin of other tenants to consent to use this app by link :
https://login.microsoftonline.com/<your tenant ID>/adminConsent?client_id=<your multi-tenant app ID>
and this app will be added into other tenants as a service principle :
so that we can use this app to do some actions through all tenants.
Just run the Powershell below to delete a user from all your tenants , I have tested on my side and it works for me. Btw, pls remove all directory roles before you run it or you will get 403 error if user is assigned some admin roles .
#config your multi tenant app id and secret here.
$appid = "<YOUR MULTI TENANT APP ID>"
$secret = "<YOUR MULTI TENANT APP SECRET>"
$userEmailaddress = "<EMAIL ADDRESS OF THE USER YOU WANT TO DELETE>"
#config all your tenents here
$tenants = "<TENANT 1 ID/NAME>","TENANT 2 ID/NAME",...
#check and delete user by email address in all tenants
foreach($tenant in $tenants){
#get token to call microsoft graph api to delete users
$body=#{
    "grant_type"="client_credentials";
    "resource"="https://graph.microsoft.com";
    "client_id"=$appid;
    "client_secret" = $secret
}
 
$result=Invoke-RestMethod -Uri "https://login.windows.net/$tenant/oauth2/token" -Method POST -Body $body 
#get user object from tenant
$userguestPrefix = $userEmailaddress.Replace('#','_')
$searchURL = "https://graph.microsoft.com/v1.0/users?`$filter=startswith(userPrincipalName,'$userEmailaddress') or startswith(userPrincipalName,'$userguestPrefix')"
$searchUserResult = Invoke-RestMethod -Uri $searchURL -Method GET -Headers #{'Authorization'='Bearer '+$result.access_token}
#remove the user from tenant
if($searchUserResult.value.Length -eq 1){
echo "remove:"$searchUserResult.value[0].displayName" from tenant : $tenant"
$removeURL = "https://graph.microsoft.com/v1.0/users/" + $searchUserResult.value[0].id
Invoke-RestMethod -Uri $removeURL -Method DELETE -Headers #{'Authorization'='Bearer '+$result.access_token}
}
}
If you have any further concerns , pls feel free to let me know .