How to add same verified domain to 2 different tenants

Domains can only ever be associated with one tenant, the only options you have are either to merge users and resources from one tenant (tenant B) into the other (Tenant A), or alternatively I would advise looking at setting up: Cross-Tenant Synchronisation for multi-tenant collaboration and resource access.

@Daniel Powley Thanks for responding back. In my case the Tenant B has a production App Registration that needs verification for branding purposes, and that can only be done with the verified domain in tenant A. Do you think Cross-Tenant Synchronization would still help?

@Divyanshu It should be able too, as you can pass through access to corporate resources and applications from other tenants.

Hi @Divyanshu

Thank you for reaching out to Microsoft Q&A.

In Microsoft Entra ID (formerly Azure Active Directory), a custom domain (for example, mycompany.com) can be verified and associated with only one tenant at a time. This is a platform-level design constraint and not a configuration issue. The verified domain becomes a unique identifier for the tenant and is used in critical identity components such as user UPNs, federation trust (SAML), token issuer validation, application identifiers, and security boundaries. Because of this uniqueness requirement, Microsoft blocks adding or verifying the same domain in a second tenant while it is already verified in another tenant. As a result, attempting to add mycompany.com to Tenant B will fail unless it is first removed from Tenant A, which would disrupt existing users, SSO, and federation configuration in Tenant A. Microsoft has clearly documented that sharing or duplicating a verified custom domain across multiple tenants is not supported.

Refer below points to resolve this issue or as supported workarounds:

Option 1: Keep the custom domain in a single (identity) tenant Maintain mycompany.com only in Tenant A, where users are already configured with Google Workspace SAML and UPNs like ******@mycompany.com. Treat Tenant A as the central identity tenant. Tenant B should remain a resource or workload tenant using its default *.onmicrosoft.com domain. Users from Tenant A can access applications and resources in Tenant B using cross-tenant access policies or B2B collaboration, while authentication continues to occur in Tenant A. This is the recommended Microsoft approach for multi-tenant organizations where consolidation is not possible.

Option 2: Use cross-tenant synchronization for user presence in Tenant B If Tenant B requires local user objects (for RBAC, Conditional Access, or application assignments), configure Microsoft Entra cross-tenant synchronization. Users are mastered in Tenant A and automatically provisioned into Tenant B. Note that the UPN suffix in Tenant B cannot be mycompany.com and will remain *.onmicrosoft.com. Authentication is still delegated to the home tenant. This allows operational separation while respecting the single-domain ownership rule.

Option 3: Use a subdomain for the second tenant If branding or application requirements in Tenant B mandate a company-owned domain, use a subdomain such as prod.mycompany.com or apps.mycompany.com. Microsoft supports verifying a root domain in one tenant and a subdomain in another tenant, as they are treated as separate DNS namespaces. This is the only supported way to have related domains across multiple tenants.

Divyanshu You cannot verify the same custom domain in two different Azure tenants at the same time.

In Microsoft Entra ID, a custom domain (for example, mycompany.com) can only be associated with one tenant. Once it is verified in Tenant A, it becomes the authoritative identity tenant for that domain, and Tenant B cannot verify it unless it is first removed from Tenant A. This behavior is by design and cannot be overridden.

Since Tenant A is handling SAML authentication with Google Workspace and Tenant B is hosting production workloads, the recommended approach is:

Keep mycompany.com verified in Tenant A (identity tenant).

Use cross-tenant access or Azure AD B2B collaboration to grant users from Tenant A access to resources in Tenant B.

Assign appropriate RBAC roles in Tenant B to those users.

Alternatively, if separation is required, you may use a subdomain (for example, prod.mycompany.com) in Tenant B while keeping the primary domain in Tenant A.

There is no supported way to keep the exact same verified domain active in both tenants simultaneously.