we have a lot of small customers with a couple of branch offices (~5 clients, no servers). There is no infrastructure and they don't have any IT personnel. For administrative reasons we would like the clients to be part of a domain. We have a root forest/domain in place and would like to add customers to our infrastructure. Since Active Directory isn't designed for multi tennancy, we are currently evaluating trust relationships. For this to work it is important that customers cannot access/enumerate others customer's ADs.

With this in mind, which of the following scenarios would work and what would probably be the best?

a) separate forests

b) one forest, separate domains

c) one forest with child domains

Additionally it would be nice if we could use a single exchange organization. Any advice is greatly appreciated.

  • 3
    If you are an MSP please don't do this. It is a disservice to your customers who are now slave to you. They cannot move to another provider without essentially gutting their network and starting over. If you tried to do this with my company I would immediately shop for a new provider. – myron-semack May 7 '17 at 16:50

Active Directory

If you really want to have Active Directory for every customer, the best solution is separate AD forest for every organization with NO trusts between them. You would need at least one server in every organization for this to work.

You should NOT create a single forest between all your customer domains or make any trusts. This is because customers do not have to access each other resources (hence no need for a trust)

Technically it is possible to have a single domain across several organizations. But in your case is not a viable solution and a very bad idea.

But if your customers are mostly 5 PC companies which probably have no servers in office, you should avoid having Active Directory all together. Try researching device management solutions (e.g. Microsoft Intune) and move your customers to a cloud management platform (e.g. Azure Active Directory)


As for Exchange your choices are:

1) Exchange Online - sell Office 365 Plans to your customers, lowest being 4$/month per mailbox 2) Hosted Exchange on your servers. You become Service Provide and support all servers, infrastructure, security, etc. This requires investment and management expenses and only makes sense if you have a large base of customers

It's much easier to go with option 1 and just get your profit from selling plans, skipping all expenses which come with option 2. Also option 1 comes with previously proposed solution to use Azure AD and cloud-based device management solution.


For administrative reasons we would like the clients to be part of a domain.

I've worked for and with a number of Managed Service Providers and none of them do this. There are a litany of reasons why this isn't a good idea.

If you need to simplify how you manage and administer the IT assets and infrastructure for your clients then you should invest in a quality RMM.


You deff want them in separate forests. This is by far the industry standard. If something went wrong, and this was a contributing factor, then you may have some liability issues because you're not following what is generally considered the industry standard.

One thing I've seen some orgs do is have what used to be called a red forest. I believe MS is now calling it an ESAE (Enhances Security Administrative Environment). There are trade-offs here.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.