Start free trial
Start free trial
How-to 5 steps 3 min read Updated 11 November 2026

How to segment a Microsoft 365 tenant by subsidiary, region or business unit

Segment one Microsoft 365 tenant by subsidiary, region or business unit so each admin sees only their part, without splitting into separate tenants.

Torsten Mandelkow Works with
How-to

What is tenant segmentation in Microsoft 365?

Tenant segmentation in Microsoft 365 means dividing one tenant into scoped parts, usually by subsidiary, region or business unit, so each group of admins sees and governs only its own users, workspaces and objects. Identity, licensing and collaboration stay in one tenant, each part gets its own administration and policies.

In short

  • Segmentation divides one tenant into scoped parts; multiple tenants separate everything.
  • The boundary is a decision first: subsidiary, country or business unit.
  • Segments usually start from an Entra ID attribute, so its quality decides the result.
  • Scope admin roles to the segment so no one needs access to the whole tenant.

Step by step

Five steps take a segmentation from a decision on paper to scoped administration that works.

  1. Decide the boundary

    Choose whether segments follow subsidiaries, countries or business units, and whether segmentation is enough or a legal boundary needs separate tenants. Write down who will administer each segment.

  2. Check the attribute you will segment on

    Confirm that the Entra ID attribute, such as country, company or department, is filled in and accurate for every user. A segment built on an empty attribute silently contains nobody.

    Tip: Run a quick count of users with the attribute missing before you build anything.

  3. Define each segment with a filter

    Create a segment per boundary by filtering users and the objects they own, for example users whose country is Germany, and decide which Microsoft 365 workloads each segment includes.

    In Rencore:

  4. Assign admin roles per segment

    Give each admin a role scoped to a segment, so a subsidiary admin sees and governs only that segment. Name a central owner who sees across all segments.

    In Rencore:

  5. Review segments and policies regularly

    Re-check segment membership after reorganizations and acquisitions, and apply the policies each segment needs. Segments that nobody reviews drift as the attributes behind them change.

Why a tenant needs segmenting

As an organization grows through subsidiaries, regions and acquisitions, one tenant gets a lot of people with different responsibilities. A central admin team ends up with all the work and all the access, while a subsidiary IT team cannot act on its own part without being given more rights than it should have.

Segmentation fixes that without splitting the tenant. Identity, licensing and cross-company collaboration stay in one place, while administration, visibility and policies are scoped to each segment. Where a legal or regulatory boundary requires fully separate tenants, each tenant can then be governed as its own environment.

Connectors in this How-to

Each connector page in the Rencore docs lists the objects, policies, reports and actions behind these steps.

Common questions about segmenting a Microsoft 365 tenant

Is segmentation the same as having several tenants?
No. Segmentation divides one tenant into scoped parts, so identity, licensing and collaboration stay in one place while administration and policies are scoped per segment. Several tenants separate everything, which suits a legal or regulatory boundary but makes guest access, shared collaboration and consistent governance harder, because each tenant has its own settings.
What do Entra ID and Purview already offer for segmentation?
Entra ID holds the attributes segmentation starts from and offers administrative units to scope admin roles to a set of users, groups or devices. Purview adds information barriers and sensitivity labels. None of them gives one view per segment across Teams, SharePoint and Exchange with that segment own policies, violations and owners together.
Which boundary should we choose first?
Choose the one tied to the strongest reason for the segment, usually where data must stay or where a subsidiary is accountable for its own administration. Country or subsidiary is easiest when the Entra ID attribute is reliable. A business unit boundary can follow once the first segment works and the attribute quality is proven.
What goes wrong most often?
The attribute behind the segment is empty or out of date. Users who moved country, contractors with no department and guests without attributes silently fall outside every segment, so admins miss them. Check the attribute coverage before you build segments, and again after each reorganization.
How does Rencore Governance segment a tenant?
Rencore Governance uses Tenant Segmentation, set up in the workspace settings under Environments and Virtual Environments. You choose the objects in a segment with filters, such as the user country in Microsoft Entra ID, and assign admin roles per segment. Each admin then sees and governs only that segment, and each tenant can also be governed as its own environment.

Last updated 11 November 2026

About the author

Torsten Mandelkow

Torsten is co-founder and CAA at Rencore. During his time as a SharePoint consultant, he always tried to improve and automate the SharePoint development process, first by creating the SharePoint Software Factory (SPSF), and later by creating the SharePoint code analysis tools, today known as SPCAF. After an intermezzo for 3 years at Microsoft, he is now part of the RENCORE team and is responsible for the further technical development of all our tools.

Related

See a tenant split into scoped segments

We will show how Virtual Environments scope each admin to one subsidiary or country in Rencore Governance, in a short demo.

Request a demoGet started free
Rencore newsletter

Subscribe to our newsletter

Get the latest insights on governing Microsoft 365, Copilot and AI agents, delivered to your inbox.

Loading form