Cross-Tenant Synchronization Identity Types
You have two Microsoft Entra tenants named contoso.com and fabrikam.com. Contoso.com contains the identities shown in the following table. You configure cross-tenant synchronization from contoso.com to fabrikam.com. Which identities will sync with fabrikam.com? - 
Community Votes
81% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests the specific limitation of cross-tenant sync: while you can scope provisioning by group membership, the group object itself does not sync to the target tenant; only the users within it do.
Microsoft Entra cross-tenant synchronization is limited to synchronizing user identities only. This page clarifies that groups are not synced as distinct objects, resolving confusion around scoping filters.
Many candidates choose D because they assume all listed entities (users and groups) will appear in the target tenant, confusing 'scoping' with 'syncing'.
Community Discussion (10 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Correct answer: A — Only User1 syncs.
Microsoft Entra ID cross-tenant synchronization has a strict limitation: it only supports synchronizing users. While you can configure scoping filters to select which users should be provisioned based on their group membership, the groups themselves are not synchronized to the target tenant. Therefore, even if Group1 and Group2 are used to filter which users get synced, those group objects do not appear in fabrikam.com. Only the individual user accounts (User1) are created in the target tenant.
Why the Other Options Are Wrong
Options B, C, and D incorrectly assume that group objects (Group1 or Group2) are replicated to the target tenant. In reality, groups remain local to the source tenant. If you need group-based access control in the target tenant, you must create equivalent groups there manually or via other automation, but the cross-tenant sync tool does not transfer group definitions.
Community Comment Notes
Community consensus strongly supports Option A. Comments highlight that "only users can be synchronized between tenants" and clarify that while groups are used for scoping, they are not synced. One commenter noted, "the scoping for groups is only to select the users and the group itself is not synchronised." Another cited Microsoft documentation stating, "Only Entra ID users can be synchronized (groups, devices and contacts are not supported)."
Official Reference
Exam Strategy
Always distinguish between 'scoping' (filtering who gets synced) and 'syncing' (what actually moves). For Cross-Tenant Sync, remember: Users sync, Groups do not. If the question asks what appears in the target tenant, exclude groups.
Frequently Asked Questions
Can I sync security groups with cross-tenant sync?
No. You can use groups to scope which users are synced, but the group objects themselves are not created in the target tenant.
Why did some think Groups sync too?
Confusion arises because scoping filters allow selection by group. However, this only determines user inclusion, not group replication.
Related Analysis
Practice All SC-300 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-300 Practice Test →