Hubs organise, groups secure
The most important point is also the most often misunderstood. A hub site groups sites together for navigation, branding, search and news. It does not decide who can see what. Associating a site with a hub does not change the site's permissions, and each site's permissions remain its own.
Access comes from Entra ID groups granted to each site. So a multi-entity design is really two designs that have to line up: a hub structure that reflects how people find things, and a group structure that reflects who is allowed to see them. Get either wrong and the other cannot compensate. A beautifully organised hub structure sitting on top of sites shared with everyone gives the appearance of separation and none of the substance.
Hub owners can choose to sync the hub's visitor permissions to associated sites, giving those visitors read access. Treat that as a convenience for genuinely open content, and check how it applies to each associated site before relying on it. It is not a substitute for granting access deliberately.
Model the entities in Entra ID first
Before designing any hub, make sure each person's account says which entity employs them. companyName is the natural attribute, though some organisations use an extension attribute. It should come from HR, use a controlled list of values, and match the legal entity, not a trading name or a cost centre.
From that, build dynamic groups per entity: all staff of Entity A, all staff of Entity B, and so on, plus a group-wide all-staff group. Add function groups within each entity where you need them. These groups become the building blocks for site permissions, navigation targeting and news.
Some people do not fit one entity. Directors with roles across several companies, shared service staff, and people seconded between entities all need more than their employing entity's access. companyName holds one value, so handle these cases with assigned groups that have a named owner and a review date, rather than bending the dynamic rules around individuals.
A few conventions keep the model readable:
- A prefix that shows type and scope, such as DYN-ENTA-AllStaff and DYN-GROUP-AllStaff.
- One attribute per decision: entity from companyName, function from department.
- A worker type condition, so contractors and volunteers are included or excluded on purpose.
- user.accountEnabled -eq true in every rule, so leavers drop out automatically.
- Dynamic membership needs a premium Entra ID licence, so confirm current requirements with Microsoft.
Choose the primary axis
A site can be associated with only one hub. That forces a decision: is the main organising axis the entity, or the function?
If entities run largely independently, with their own leadership, finance and HR, entity hubs usually work best. Each entity gets a hub with its own branding and navigation, and its sites sit beneath it. A group hub sits above for shared news and policies, with the entity hubs associated to it. Keep that hierarchy shallow: two levels are easy to explain, and every extra level makes navigation and search scope harder to predict.
If the group runs shared services, where one finance team serves every entity, a functional structure fits better. Finance, HR and IT hubs serve everyone, and entity identity comes through audience targeting and permissions rather than through the hub structure.
Most groups are a mix. A common pattern is a group hub at the top, entity hubs for entity-specific operations, and functional hubs for shared services, with each site associated wherever most of its users would expect to find it. Write that rule down so site owners can apply it without asking.
Permissions per site, using entity groups
Grant each site to groups, never to individuals. An entity's operational sites get that entity's groups. Group-wide policy sites get the group-wide all-staff group as visitors. Shared service sites get the service team as members and the entity groups they serve as visitors.
Watch the defaults, because several of them cross entity boundaries quietly. Sharing links scoped to people in your organisation, the Everyone except external users claim, and public Microsoft 365 groups and Teams all reach every entity in the tenant. If entities should not see each other's content, set the default sharing link to specific people or people with existing access, make private the default for new Teams, and remove organisation-wide access from existing sites before associating them.
If separation is a legal or regulatory requirement rather than a preference, permissions alone may not be enough. Information barriers in Microsoft 365 can restrict communication and sharing between defined segments, with their own licensing and design effort. Take advice on what your obligations actually require, and confirm licensing with Microsoft, before committing to them.
Navigation, news and audience targeting
Hub navigation is shared by every site associated with the hub, which is where the structure becomes visible to staff. Keep it short and task-focused. Use audience targeting on navigation links so Entity A staff see Entity A's links and the group's shared links, and not Entity B's. Audience targeting uses Entra ID groups, so your entity groups do double duty.
Audience targeting is a relevance tool, not a security tool. A hidden link to a site the person can access is still reachable through search or a shared URL. Never rely on targeting to keep content private.
Publish group-wide news on the group hub and entity news on entity hubs, and target news to audiences where it applies to one entity only. Agree who can publish where, so the group hub does not fill with local notices.
Branding is where entities feel most strongly, and where it is easiest to overspend effort. A hub theme and logo per entity is usually enough to make staff feel at home without fragmenting the design. Agree a shared page layout and a small set of templates across the group, so moving between entity hubs does not mean learning a new intranet each time.
Search, Copilot and oversharing
Searching from a hub returns results from its associated sites, which can feel like entity separation. It is not. Search respects permissions, so anything a person can access can appear in their results somewhere. Oversharing between entities tends to show up in search first.
The same applies to Microsoft 365 Copilot, which works over content the person can already reach. If you are planning Copilot across the group, a clean entity group model and tidy site permissions are among the most useful things to have in place first.
Before go-live, check the existing estate rather than assuming it starts clean. Look for sites shared with Everyone except external users, sites with organisation-wide sharing links, public Teams holding entity-specific material, and libraries with broken inheritance granting access to individuals. Fix these as part of associating each site with its hub, not as a separate project that never quite finishes.
Provisioning and ownership
Structure decays when sites are created ad hoc. Decide who can create sites and how they get associated with the right hub. Rights to associate sites with a hub can be limited to named people or groups, so only the relevant site owners or IT can attach sites to an entity hub.
A simple request process works: the requester names the entity, the function, an owner and a deputy, and provisioning creates the site, applies the naming convention, associates it with the right hub and grants the right groups. At low volume this can be manual. At higher volume, use a flow or script so the steps happen the same way every time.
Plan for the end of a site's life as well as the start. Sites outlive projects, owners leave, and orphaned sites keep whatever access they had on the day their owner moved on. Review sites without an active owner on a schedule, reassign or archive them, and make sure the entity groups on each site still match the entity that owns its content.
Ownership needs to be clear across the group:
- Group IT owns the hub structure, naming, provisioning and the Entra ID group model.
- HR in each entity owns the accuracy of the attributes that drive entity groups.
- Each entity names an intranet owner for its hub's navigation and news.
- Site owners decide which groups get access to their sites and review it periodically.
- Information governance agrees which content must not cross entity lines.
Movers, acquisitions and disposals
Staff who move between entities are handled by changing companyName in HR. Their dynamic group membership updates, their navigation and news change through targeting, and their access to the old entity's sites ends. As with any mover, handle handovers with time-limited assigned access, not edits to rules.
Acquisitions add an entity: a new attribute value, new groups, a new hub if the entity is large enough to need one, and content moved into sites built on the model. If the acquired business has its own tenant, that is a tenant-to-tenant migration first, and the structure decisions should be made before any content moves.
Disposals are harder, which is the strongest argument for keeping each entity's content in its own sites from the start. Sites that clearly belong to one entity can be separated as a unit. Content mixed into shared sites has to be untangled by hand, under time pressure, when a sale is already agreed.
Sequencing the work
The order matters more than the speed. Doing permissions after hubs are live means staff see a structure that promises separation it does not yet have. Doing groups after permissions means granting access twice, once to individuals and again to groups.
We usually pilot with one entity end to end before rolling out across the group, because decisions about shared services and naming tend to surface only when real sites are being associated. A typical sequence:
- Agree entity definitions and attribute values with HR.
- Clean the attributes and build entity and function dynamic groups.
- Fix tenant sharing defaults and remove organisation-wide access from existing sites.
- Create the hubs and agree the association rule.
- Associate existing sites, fixing permissions as you go.
- Configure navigation, audience targeting and news.
- Open site provisioning to owners once the request process is in place.