"It's the equivalent of setting up a trust between two tenants in Azure Active Directory, the difference being that it's done at an individual group or user level between the tenants," Simons said.

Under this scheme, organizations can access Microsoft's services using their own local Active Directory ... "public key/private key encryption between Azure AD and on-premises agents." ...