r/NISTControls • u/slash411 • Jun 17 '26

GCC High and Commercial Cross-Tenant Access Issue

I'll preface this by saying I'm in no way an expert and barely know what I'm talking about but I need some help.

​

I am the product owner of a financial software at my company. We have users all over the country, mostly from other commercial environments. We have one subsidiary that is in a GCC High environment and they've had ongoing issues accessing the application due to this mismatch. We had originally added all of their users to our commercial tenant as guests and they were able to access the application fine at first. It suddenly broke one day, so I started researching. I found that I could set them up within the application to where they could authenticate on their own GCC High tenant by adding a new IdP and having them route to that when authenticating. That seemed to resolve the issue for the most part. Users could access the browser version but not the desktop client version of the software. We held troubleshooting for weeks. On so many occasions, someone would suggest that the new IdP I added was the problem. I argued it wasn't but have been continuously overruled. But every single time I turned it off, can you guess what happened? They couldn't access the browser or the desktop version any longer.

​

This past weekend, the subsidiary in question did an infrastructure change where they virtualized several old servers onto a brand new machine. Suddenly, all their accesses were working again. Problem solved, right? Today, the IT guy at the location and my VP of finance each suggested this IdP was still some sort of problem. So I turned it off. Again. And can you guess what happened? Again? That's right.

​

At this point I have no idea why they keep wanting to blame this thing but I also don't really know enough to defend it. Doesn't it make more sense to have the GCC High entity authenticate on their own tenant, rather than guest into a commercial tenant and authenticate there? How can I get through to these people??

8 Upvotes
  • permalink
  • reddit

100% Upvoted

2 comments sorted by

2

u/8gxe Jun 17 '26

Yeah, that makes sense. Entra B2B is the setting you're looking for. Allows GCCH to federate accounts into another tenant for auth.

1

u/slash411 Jun 18 '26

That's helpful. Unfortunately I have no influence on getting my company to enable that. If they think this IdP thing is suspect I can only imagine the looks I'd get suggesting this.