How to Use Multiple Domains with Separate SharePoint Sites in One Tenant
Question details
The user needs to configure distinct, isolated SharePoint environments for multiple verified domains within a single Microsoft 365 tenant.
- Product
- SharePoint Online
- Device & OS
- not provided
- Scenario
- An organization manages a single Microsoft 365 tenant hosting multiple domains and wants to create separate SharePoint workspaces for the users of each domain.
- Observed behavior
- SharePoint Online does not automatically create fully isolated instances or separate environments for each domain added to the tenant, requiring manual site separation.
Ensure you have SharePoint Administrator or Global Administrator privileges in your Microsoft 365 tenant, and verify that all necessary custom domains have been added and authenticated in the Microsoft 365 Admin Center.
Configure Permission-Based Site Isolation for Each Domain
Since SharePoint does not automatically segregate environments by domain, you must manually create individual sites and restrict access using domain-specific user groups.
In a single Microsoft 365 tenant, site separation depends entirely on permissions rather than the user's email domain. You must configure groups explicitly so that users from Domain A cannot access the site built for Domain B.
Log in to the SharePoint Admin Center. Navigate to 'Sites' > 'Active sites' and click 'Create'. Build a distinct Communication site or Team site for each domain.
Go to the Microsoft 365 Admin Center. Navigate to 'Teams & groups' > 'Active teams and groups'. Create separate Microsoft 365 or Security groups and populate them exclusively with the users belonging to the respective domain.
Open each newly created SharePoint site and navigate to 'Settings' (gear icon) > 'Site permissions'. Remove any tenant-wide access (like 'Everyone except external users') and grant access only to the specific domain group you created in the previous step.
Return to the SharePoint Admin Center. Select a site, open its details panel, and click the 'Policies' tab. Under 'External sharing', adjust the sharing permissions to prevent cross-domain or unauthorized external access as required by that specific domain's policies.
Migrate to Separate Microsoft 365 Tenants for Strict Isolation
If your organization requires absolute administrative, legal, or data residency isolation, separating the domains into entirely distinct Microsoft 365 tenants is the only supported method.
Edit Your SharePoint Documents Freely with WPS Office
While Microsoft 365 manages your SharePoint site architecture and domains, you can significantly reduce desktop software licensing costs. WPS Office is a lightweight, highly compatible alternative to Microsoft Office that lets you effortlessly open, edit, and collaborate on Word, Excel, and PowerPoint documents downloaded from your SharePoint sites.
- 1. Download and Install: Visit the official WPS Office website to download and install the software securely on your Windows, Mac, or Linux device.
- 2. Open SharePoint Files: Download your document from SharePoint, right-click the file, and select 'Open with WPS Office' to begin editing.
- 3. Save and Upload: Save your edits in their native Microsoft formats and seamlessly upload them back to your designated SharePoint site.
Frequently Asked Questions
Can I link a specific domain directly to a separate SharePoint site URL?
No. While you can change the primary SharePoint domain name for the entire tenant, you cannot have multiple custom domain URLs (like site.domainA.com and site.domainB.com) for different sites within the same tenant.
Does a user's email domain automatically restrict their SharePoint access?
No, SharePoint access is entirely governed by site permissions and Microsoft 365 group memberships. A user's email domain suffix does not automatically restrict or grant them access to any particular site.
Can external sharing be customized individually for each domain's site?
Yes. In the SharePoint Admin Center, you can adjust the external sharing level (e.g., Anyone, New and existing guests, Only people in your organization) individually for each active site, regardless of the tenant's global sharing settings.
